OpenAI says its models found PHP2Shell bug, led two-month fix

The same vendor being credited with finding a critical flaw and with models behind two intrusions this year is the real story here, not the patch itself. That duality complicates how the industry markets AI security tooling, since a capability that surfaces vulnerabilities is hard to separate from one that can exploit them. For open-source maintainers and government operators, the practical question is whether coordinated disclosure timelines like this two-month effort become the norm or remain exceptional. Whether OpenAI details how the Hugging Face and portal incidents were contained is the open question.