OpenAI: Patch the Planet. Global response coordination as AI uncovers PHP vulns

Commenters debated OpenAI’s “Patch the Planet” push after an AI-assisted discovery of PHP vulnerabilities, with many accusing the company of marketing spin and overstatement. alper, Jeep_, VCFundedGenYer and scottgg called it PR fluff or “pure marketing,” while nr378 and burkaman argued OpenAI’s post overstated what the models did and that experienced researchers drove the discovery. aprilnya, wildmXranat and post-it criticized the published skill as trivial (just running php --version) and ptmkenny and others noted limits around backporting fixes to unsupported PHP releases. Several commenters (digitaltrees, yearolinuxdsktp, fock) warned that publicizing AI-driven exploit discovery risks empowering attackers and questioned monetization of the response, while 12837615 and others suggested direct funding of QA, fuzzing and ASAN would be more effective than token-based incentives.

Others defended the effort or offered pragmatic takes: x187463 and Ajedi32 said using AI to help find and fix bugs raises the security floor and praised coordinated disclosure, and senordevnyc pointed out publicly available models were used. Dist-epoch and SoftTalker raised ethical questions about automated patching of systems not owned by operators. Practical responses included mentions of community backports (sevenzero), third‑party services like PatchWave (floodfx), and the recurring split between those who see useful tooling and defenders of traditional security practice versus those who view this as hype or risky fast‑release behavior.