OpenAI coordinated a two-month effort to address two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619. These flaws, which received a CVSS score of 9.2 out of 10, could allow remote code execution on affected servers. The project was part of the company's Patch the Planet initiative, involving researchers, PHP maintainers, and security providers.
The vulnerabilities were discovered using AI models, including GPT-5.6 Sol, and independently verified by the cloud security firm Wiz. Because the fixes required significant changes to the PHP engine, the release was scheduled for October 21. PHP is estimated to power 70% of websites, making these flaws particularly impactful.
Following reports of premature information leaks, some European government websites temporarily went offline to mitigate risks. Cloudflare reported several attack attempts shortly before the patches were released. Developers have issued updates for PHP versions 8.2 through 8.5 to address the security gaps.
OpenAI has proposed a new coordination framework for handling similar incidents, emphasizing early notification of organizations and government agencies. The company expects that as AI technology advances, it will be increasingly used to identify critical software vulnerabilities, potentially outpacing traditional discovery methods.
