PHP patches two critical flaws, one found with OpenAI's GPT-5.6 Sol
PHP says the attack can land before a site's own code runs, and that updating is the only safe choice.
On October 21, 2026, the PHP project shipped emergency releases fixing two critical flaws that can let an attacker run code on a web server without logging in. PHP had warned the day before that a release was coming, rating both flaws 9.2 out of 10.
One of them was found with an AI model. OpenAI says Calif, a security firm in its Patch the Planet program, identified a critical flaw using GPT-5.6 Sol, and that Wiz found and reported both on its own. OpenAI then spent two months coordinating the fix.
- Flaws
- CVE-2026-109618 and CVE-2026-109619
- Rated
- CVSS v4.0 9.2
- Fixed in
- PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
- Who is at risk
- all PHP installations serving web requests
- PHP 8.1 and older
- no longer receive updates from the PHP project
What the two flaws do
Both live deep in how PHP handles a request. The first, CVE-2026-109618, comes from out-of-memory handling that can interrupt PHP while request data is only partly set up, so the cleanup afterward treats junk as real. The second, CVE-2026-109619, lets internal state survive after its memory has been freed, and a later request on the same worker can pick it up.
We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.
That last part matters. A site can keep its own app fully up to date and still be exposed, because the attack lands before the app's code ever runs. PHP lists config changes that narrow some attack paths (turning off session upload progress is one), but it's blunt about them. Its release notes say there are no complete mitigations and updating is the only safe choice.
What OpenAI did with the finding
OpenAI's account is that it led a coalition of maintainers, researchers and security companies, while PHP's own maintainers wrote the fix. On X it said the work took two months because the fix was intricate and needed a major change to the PHP engine. It also says it brought in the White House's Super Intelligence Force, the Office of the National Cyber Director and CISA before disclosure.
OpenAI's Greg Brockman used the nickname the bug had picked up by then.
Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory, php2shell, found as part of our Patch the Planet initiative.
The part of OpenAI's post that reaches past PHP is the next line. It calls these bugs among several significant ones it has already found and is working to fix.
we expect similar findings to increase sharply in the coming months
So OpenAI is proposing a five-stage process for handling them, from validating the bug with the maintainer through to public guidance, and it's asking the security world to pick holes in it. It's also committed $1 billion in subsidized access to Daybreak, its security product, for organizations with thin security budgets that protect essential services. (Daybreak's misuse classifiers are still being tuned, OpenAI says, since blocking abuse can also block real security work.)
Who has to patch, and who can't
The reach is the story outside the industry. W3Techs, which surveys websites, says PHP runs on 69.3% of the sites whose server-side language it can identify. For a lot of site owners the fix isn't theirs to make. PHP says Linux distributions and long-term support vendors got the patches in advance, and tells people to check with their vendor for updated packages.
Some sites have nobody to ask. PHP 8.1 and older get no updates from the project. Given the severity, PHP's security team made rough source backports for 7.4, 8.0 and 8.1, though that only helps people who build PHP themselves. It also told users of rpms.remirepo.net, a volunteer-run package source, to switch to their distribution's packages, because that repo wouldn't have updates on release day.
Ethan Mollick described the load this puts on companies, and where it goes next.
Companies I talk to are struggling with the rate of patches they need to do thanks to AI defenses finding issues before the inevitable wave of incoming cyberattacks by other AIs. Now consumers are going to have the same experience of getting everything updated often & fast.
OpenAI's post raises a harder question for governments. It asks when, if ever, governments or other operators should use a vulnerability to patch systems they own or are authorized to manage after losing administrative access. It goes as far as sketching internet-wide scanning that would warn site owners, or patch them. It doesn't say who would run that.
PHP 8.2 reaches end of life on December 31, 2026, and gets no security fixes after that date.
More on OpenAI
- OpenAI says a GPT-6 Astra agent removed a safety monitor, then denied itOctober 21, 2026
- OpenAI says GPT-6.1 Sol scores 86.6% on its COBOL migration test, up from 5.4%October 20, 2026
- Prosecutors say the OpenAI bugging suspect was in frequent WhatsApp contact with a Saudi royalOctober 19, 2026
- ChatGPT can now control your Chrome tabs, sending messages and filling out forms for youOctober 16, 2026
