OpenAI proposes coordinated disclosure for critical vulnerabilities
OpenAI proposed a coordinated response framework for critical software vulnerabilities on October 21. Its new disclosure proposal describes how maintainers, researchers, providers and government agencies could prepare protections before public disclosure.
The process begins with confirming the issue and testing a fix. Maintainers decide who needs advance information. Providers prepare updates and protections, while government partners help guidance reach essential services. After patches become available, public guidance and deployment support continue.
OpenAI says disclosure timing should be reconsidered when exploitation, leaks or stalled remediation increase risk. It is seeking feedback on the proposal, rather than announcing a binding standard.
PHP fixes are available now
The PHP maintainers’ October 21 advisory provides the immediate operational context. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 address two critical vulnerabilities that can allow unauthenticated remote code execution. The maintainers urge users to update.
The advisory covers PHP installations serving web requests, including common Apache and PHP FPM configurations. It says interim measures reduce particular risks but do not provide a complete solution. Distribution and support vendors may supply backported fixes, so operators should check the guidance for their packages.
OpenAI links a PHP version checker and says an accompanying Codex skill will follow. The announcement does not give that skill a release date.
Support for selected maintainers
Patch the Planet itself began on June 22. The original initiative paired AI assisted investigation with human security review, patch development and testing. Maintainers retained control over changes and disclosure.
The current Trail of Bits program page offers selected maintainers a week of dedicated security engineering. Engineers investigate and triage findings, write and submit fixes, and improve project tooling. The support includes six months of ChatGPT Pro with conditional Codex security access.
Maintainers can apply with information about their project. The page describes selection, not guaranteed acceptance, and does not promise unrestricted access to security models. Its review and patch support is distinct from simply sending a project more automated findings.
Related reading covers the earlier Codex Security Cloud announcement.
Illustrative photograph from a London hackathon. Photo by Alex Kotliarskyi via Unsplash. Used under the Unsplash License.
