PHP's one-employee foundation meets AI-speed bug hunting as OpenAI lifts bounties

Emergency updates, and a name

Two critical flaws in PHP were found by a team using OpenAI's AI models, and patched versions followed shortly after the warning. According to Cloudflare, the impact extends to web servers running PHP 5.4 and later.

Anyone running a website now carries the patching decision alone. The fixes exist, but no authority forces installation. Regulators and buyers get a worked example of what maintaining shared code costs. A language used by about 69% of sites with a known server-side language is kept by one salaried employee and about 14 part-time contractors. That comparison is the one to hold on to. What nobody has published is how many installations are still unpatched.

A release dated 3 November said governments had warned administrators to undertake emergency updates, and it grouped the flaws under the name PHP2Shell. The release was distributed through TrillionDollarClub, a communications platform inside the Dynamic Brand Portfolio at IBN. A name travels faster than a patch. The label arrived with the release, after the patches did.

In some cases government websites were forced to suspend operations, and delays in applying updates were still being flagged after fixes shipped. Whether to apply them is left to individual site owners.

Millions of attempts in a day

Cloudflare chief executive Matthew Prince said on X that millions of attack attempts were observed within 24 hours of disclosure, and thousands before it. The FBI's cyber division warned on X that the flaws could enable remote code execution in the PHP core, putting sensitive data and networks at risk.

Hosting providers moved at different speeds. Cloudflare added web application firewall rules to detect and block attacks. GoDaddy updated its managed and Windows hosting, so those customers need take no further action. Self-managed sites and VPS operators were told to update themselves. Cloudflare also opened a capture-the-flag contest on HackerOne, inviting researchers to break a deliberately vulnerable PHP environment behind its own firewall, with prizes from $100 to $10,000.

Thousands of attempts before disclosure. Millions within a day of it.

The foundation with one employee

Elizabeth Barron, executive director of the PHP Foundation, said she is the organisation's only full-time employee. She works alongside about 14 part-time contract staff and unpaid board members.

W3Techs estimates PHP is used by about 69% of sites whose server-side language is known. Demand for code fixes has doubled, Barron said, but "the number of collaborators has not doubled". She added that "it is clear that funding to support PHP is severely lacking". The companies and governments that depend on the language have not changed their structures, in her account, even as the queue in front of her team grew.

One salaried employee. About 14 contractors. Roughly seven sites in ten.

Attack attempts rose sharply after disclosure, and the foundation's capacity did not rise with them.

Why AI changes the arithmetic

The PHP2Shell release argues AI can find and exploit software weaknesses at a speed human defenders struggle to match. Because PHP is freely available and widely deployed, a single set of flaws ripples across millions of sites, small businesses and public services that lack dedicated security teams.

OpenAI's bounty numbers make the same point from the other side. The company now pays up to $30,000 for a critical vulnerability in core products such as ChatGPT or Codex. Exceptional findings can reach $100,000, and quality, loyalty and campaign bonuses take the total to roughly $172,000. It quadrupled payouts, introduced a five-tier loyalty programme and will pay the difference retroactively to anyone who reported in the previous 30 days. That puts OpenAI in the same ballpark as Google's general vulnerability rewards program, though still below the top-tier payouts Apple or Microsoft offer for OS-level exploits. A security sprint with the firm Cathedral comes next; during the last one, 25% of OpenAI's product engineers worked on finding vulnerabilities, according to the company.

Set the two budgets side by side. A critical OpenAI flaw can be worth about $172,000. The top prize in Cloudflare's PHP capture-the-flag is $10,000.

What happens next

A survey of 121 US small business owners with their own websites, run by Network Solutions, found that 45% had never heard of PHP.

So the fixes sit in a queue nobody owns. Patching remains a per-site decision, with no central enforcement. The remedies on offer are familiar: faster updates, more money for maintainers, better disclosure. None of them carries an enforcement mechanism. The gap between what AI can find and what a one-employee foundation can fix is now the operating condition for a large share of the web.

Barron's ask is for money, not for a new regulator. Whether funders listen is the open question, and the survey above suggests many site owners would not notice either way.