OpenAI has identified two critical memory-safety vulnerabilities in the PHP programming language, tracked as CVE-2026-109618 and CVE-2026-109619. Both flaws have a CVSS severity rating of 9.2 and could allow unauthenticated remote code execution, potentially granting attackers control over affected servers.
The vulnerabilities were discovered through an audit conducted under OpenAI’s Patch the Planet initiative, which launched in August 2026. This project represents the first public instance of AI being used to identify vulnerabilities at an internet scale before exploitation.
Emergency patches were released on October 21, 2026, for PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The development of these fixes took approximately two months and involved collaboration between PHP maintainers, outside security firms, and teams from Google and Wiz.
To assist with remediation, OpenAI released a tool called php2shell-checker, which allows operators to assess their systems for exposure. Additionally, the company's AI coding agent, Codex, can be used to verify if a specific website’s PHP version is vulnerable to these flaws.
