Over the past two months, a coalition led by the Patch the Planet initiative worked with maintainers, researchers, and security providers to address critical vulnerabilities in PHP, the open-source language used to run websites and web applications. Calif identified a critical flaw using GPT-5.6 Sol; Wiz independently discovered and reported both vulnerabilities. PHP’s maintainers led the fixes and release, while partners including Wiz and Cloudflare contributed research, technical support, and coordination to prepare protections ahead of disclosure. The article calls the PHP flaws among the most impactful security issues in recent memory and says frontier AI found them before attackers did, opening a “Defender’s Window” for maintainers and security providers to prepare. The initiative shares a PHP version checker as a Codex skill so operators can identify potentially vulnerable versions. It also committed $1 billion in subsidized Daybreak access through Daybreak for Frontline Defenders, aimed at organizations with limited security resources protecting essential services.

Because getting a fix into use can mean adapting it for older releases, preparing provider mitigations, and updating systems across many organizations, Patch the Planet proposes a repeatable five-stage response framework. Stage one validates and fixes the upstream vulnerability, including adversarial testing with frontier models to look for ways around the patch and related variants. Stage two gives affected organizations time to act through advance information sharing; distributors may adapt a fix for an older release, hosting providers may test mitigations, and security providers may prepare detection or prevention measures such as web application firewall (WAF) rules. Stage three coordinates with government partners; for PHP this involved the White House’s Super Intelligence Force, the Office of the National Cyber Director, CISA, and international partners. Stage four prepares updates across affected products as the fix and disclosure plans stabilize, and stage five publishes guidance and supports deployment once a patch is available. The framework weighs an organization’s protective role, the time needed to act, and its ability to handle sensitive information, with maintainers deciding whom to involve ahead of disclosure. Participants receive only the information needed for their work, from network logs with indicators of compromise to more sensitive working proof-of-concept exploits; even limited details can reveal a vulnerability, so the risk of sharing is weighed against the protection it enables. Timelines are reassessed if there is active exploitation in the wild, a leak, a revealing public patch, or stalled remediation.

The Patch the Planet website aggregates public disclosures and guidance, pointing operators to PHP’s official patch and upgrade instructions, partners’ technical research, interim mitigations, when to involve a provider or expert, and backup and recovery steps. CISA’s prioritization and remediation guidance helps operators decide between emergency patching, immediate mitigation, or a planned update, plus forensic triage if systems may already be compromised. To give maintainers capacity, the initiative funds subscriptions for maintainers through Codex for OSS, directly sponsors projects such as the Rust Foundation, and offers hands-on engineering help; open-source projects can apply to Patch the Planet for support. Reusable tests and security workflows are meant to reduce the effort for future findings. The article also notes it is calibrating additional blocking classifiers for Daybreak, acknowledging that safeguards to prevent abuse can block legitimate security work, and that broad access and effective misuse protections are both critical.

Beyond individual fixes, the initiative wants to build more secure software foundations: helping developers choose safer defaults and use security libraries correctly, moving critical components to memory-safe languages, applying formal verification to widely used components, and strengthening sandboxes that limit damage from compromised software that processes untrusted files, images, or media. The article explicitly asks the security community for input on disclosure windows, emergency patching, early notice, and secure-by-default software packages. It raises the question of when governments or operators should use a vulnerability to patch systems they own or are authorized to manage after losing administrative access, and imagines an end-state of internet-wide always-on scanning for known vulnerabilities, either notifying site owners or patching systems. It also asks who needs advance warning, when staged notifications beat notifying a wider group at once, and how to weigh coverage against leak risk. Recommendations for independent security experts to review the approach are welcome.