The Pulse
OpenAI Says AI Helped Find Two Critical PHP Flaws
OpenAI says Calif used GPT-5.6 Sol to find a critical PHP flaw, while Wiz independently found both vulnerabilities. PHP released fixes for two flaws that can allow unauthenticated remote code execution and urged users to update.
AI.info Team · Written with AI · fact-checked ·
PHP maintainers released emergency security updates on October 21, after researchers found two critical flaws in the language’s core that can let unauthenticated attackers run code on affected servers. OpenAI says Calif researchers used its GPT-5.6 Sol model to identify one flaw; security firm Wiz independently discovered and reported both. OpenAI says, to its knowledge, frontier AI found the vulnerabilities before attackers did.
Two flaws in PHP’s request handling
The vulnerabilities affect PHP itself, not a particular content-management system or plugin. PHP’s advisory says one flaw can arise when an out-of-memory condition interrupts request processing while internal data is only partly initialized. The other involves request-related state that can remain accessible after the memory behind it has been freed.
PHP assigned the issues CVE-2026-109618 and CVE-2026-109619, each with a CVSS v4.0 score of 9.2. The project says installations serving web requests are at risk, including PHP-FPM, Apache’s mod_php, php-cgi, FrankenPHP and LiteSpeed; it identifies mod_php as the highest-risk configuration for a demonstrated attack path. Wiz says its researchers combined the vulnerabilities into an exploit and demonstrated unauthenticated remote code execution against WordPress, Drupal and Joomla deployments, while stressing that the underlying flaws are in PHP rather than those applications.
Maintainers released fixes across supported versions
The PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 with fixes, and urged users to update immediately. Linux distributions and long-term-support vendors received patches in advance, so administrators using vendor packages should check for the appropriate updated release. PHP 8.1 and older no longer receive updates from the project, though some distributions and vendors provide backported fixes.
PHP describes temporary configuration changes as ways to reduce exposure to particular attack paths, not as a complete remedy. Its advisory says updating is the only complete solution. OpenAI also published a PHP version-checking tool as a Codex skill to help operators identify versions that may need attention.
AI discovery came with a coordinated response
OpenAI says its Patch the Planet initiative brought together maintainers, researchers and security providers over roughly two months. PHP’s maintainers led the fixes and release, while OpenAI, Wiz, Cloudflare and other partners contributed research, technical support and preparation for disclosure. OpenAI also says it worked with U.S. government agencies and international partners to help distribute security guidance.
“To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender’s Window for maintainers and security providers to prepare fixes and protections ahead of disclosure.”
OpenAI
That claim is qualified: OpenAI says “to our knowledge,” rather than asserting that no attacker had found the flaws. Wiz’s separate account says its researchers used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol during their research, and describes AI as helping make complex exploit development and adaptation practical. The disclosures show how multiple teams and tools contributed to finding and validating issues; they do not establish that one model alone discovered both vulnerabilities.
The patch is the immediate test
OpenAI says it has committed $1 billion in subsidized Daybreak access for organizations with limited security resources protecting essential services. It also argues that future vulnerability reports will require coordination among software maintainers, distributors, hosting providers and defenders, so fixes and protections can be prepared before public disclosure. For PHP operators, the immediate instruction is less abstract: identify the runtime in use and install the applicable security update.