# Altman Urges AI Defense Shift as PHP Fixes Two Critical Flaws By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/39693 Published: 2026-10-24T05:44:01.000Z Updated: 2026-10-24T05:44:01.000Z Section: Technology > OpenAI said its partner Calif used GPT-5.6 Sol to identify one PHP flaw; Wiz independently found and reported both. OpenAI CEO Sam Altman urged defenders to use AI for cybersecurity, warning that models may find flaws outside familiar threat models as PHP maintainers fixed two critical vulnerabilities. At an Oct. 21 event hosted by Stanford Graduate School of Business, Altman said AI models could uncover bugs beyond the threat models security teams usually anticipate. “I no longer think we're going to be able to just patch all the bugs,” he said. He called for defenders to change their approach and use the same technology to build a new kind of defense. Altman was describing the challenge of fixing bugs one by one; PHP’s two vulnerabilities were patched in releases that day. OpenAI said its partner Calif used GPT-5.6 Sol to identify one of the flaws. OpenAI also said Wiz independently found and reported both vulnerabilities, while PHP maintainers led the fixes and release. The PHP releases were versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The vulnerabilities could allow unauthenticated remote code execution, meaning an attacker could run code without first signing in. TokenPost previously covered [the AI-assisted PHP findings](). OpenAI’s proposed response process calls for software maintainers, distributors, service providers and affected operators to coordinate fixes and deployment. Finding a flaw is only one part of that work; protections also need to reach affected systems. OpenAI’s cybersecurity framework places a model in its “Critical” tier if it can independently develop working zero-day exploits for many hardened, real-world critical systems or carry out novel end-to-end attacks against hardened targets from a broad objective. In an Aug. 7 update, OpenAI said preliminary evaluations of its upcoming Astra model were strong enough that it could not rule out the threshold. The company did not say Astra had crossed it. ## Links in this article - [the AI-assisted PHP findings](https://www.tokenpost.com/news/technology/37622)