OpenAI Patch the Planet: GPT-5.6 Sol helped find two critical PHP RCE flaws, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
On Oct 21, PHP published a security advisory fixing two critical unauthenticated remote code execution flaws (CVE-2026-109618, CVE-2026-109619) affecting every PHP install serving web requests, with mod_php at highest risk. OpenAI disclosed the same day that Calif found a flaw using GPT-5.6 Sol under its Patch the Planet initiative, with Wiz independently finding and reporting both; OpenAI coordinated a two-month disclosure and committed $1B in subsidized Daybreak access for under-resourced defenders.
Key Takeaways
- Flaws: CVE-2026-109618 (memory corruption via OOM handling) and CVE-2026-109619 (stale global state across requests), both unauthenticated RCE (PHP official)
- Fix: upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35; PHP says there are no complete mitigations and updating is the only safe choice
- Scope: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed are affected, with a demonstrated exploit on mod_php
- AI role: Calif found a flaw with GPT-5.6 Sol, Wiz reported both independently; OpenAI coordinated a ~2-month disclosure (vendor account)
- Investment: OpenAI committed $1B in subsidized Daybreak access and will ship a Codex skill to check PHP versions
Linked Models & Agents: