AI helped find two critical PHP flaws: what to do now
On 21 October 2026, OpenAI said it led a coalition over two months to fix two critical vulnerabilities in PHP, the open-source language used to run websites. Calif found one using GPT-5.6 Sol, and Wiz independently reported both. PHP's maintainers released the fixes, and OpenAI says applying them is now the priority.
The short version
- 01OpenAI says it led a two-month response to two critical PHP flaws.
- 02Calif found a critical flaw using GPT-5.6 Sol; Wiz also found both independently.
- 03PHP's maintainers led the fixes and the release.
- 04OpenAI shares a PHP version checker and is launching a Codex skill.
- 05OpenAI committed 1 billion dollars in subsidized Daybreak access for defenders.
At a glance
| Announced | 21 October 2026 |
|---|---|
| Software | PHP, an open-source web language |
| Found by | Calif (using GPT-5.6 Sol) and Wiz, independently |
| Fixed by | PHP's maintainers |
| Defender fund | 1 billion dollars, Daybreak for Frontline Defenders |
| Status | Confirmed |
What did OpenAI announce?
OpenAI said it led a coalition of maintainers, researchers and security providers over the past two months to address critical vulnerabilities in PHP, an open-source programming language used to run websites and web applications.
Calif identified a critical flaw using GPT-5.6 Sol as part of OpenAI's Patch the Planet initiative, with Wiz also independently discovering and reporting both vulnerabilities. PHP's maintainers led the fixes and release.
What should website operators do?
OpenAI says the priority now is applying the fixes. It is sharing a PHP version checker and will launch a Codex skill to help operators identify potentially vulnerable PHP versions.
PHP's own site carries a security advisory banner: "Critical remote code execution vulnerabilities, update now".
What does the media report about the flaws?
The Record reports the flaws are CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 and critical, and that they can allow remote code execution on unpatched sites. It also reports that hundreds of websites went offline as administrators responded, and that PHP 8.1 and older no longer receive updates from the PHP project.
These details come from The Record, not from OpenAI. We label them Reported.
What is the 1 billion dollar commitment?
OpenAI says it has committed 1 billion dollars in subsidized Daybreak access through Daybreak for Frontline Defenders, aimed at organizations with limited security resources that protect essential services.
OpenAI also says the same AI capabilities can help attackers rapidly develop offensive tools and exploits.
Why does it matter?
OpenAI says that to its knowledge frontier AI found these flaws before attackers did, giving maintainers time to prepare fixes. It also says it expects similar findings to increase sharply in the coming months.
What's next?
OpenAI is asking the security community to help improve its proposed five-stage response framework. Operators should apply PHP's fixes and follow their providers' guidance.
Questions people ask
What are the PHP flaws?
Two critical vulnerabilities in PHP. The Record reports they can allow remote code execution on unpatched sites.
Who found them?
OpenAI says Calif found a critical flaw using GPT-5.6 Sol, and Wiz independently found both.
Who fixed them?
PHP's maintainers led the fixes and the release, with OpenAI and partners helping.
What should I do?
Apply PHP's fixes and follow your provider's guidance. OpenAI shares a PHP version checker.
How much is OpenAI committing for defenders?
1 billion dollars in subsidized Daybreak access, for organizations with limited security resources.
Sources
- PrimaryOpenAI: Patch the Planet: global response coordination as agents uncover critical vulnerabilities (21 Oct 2026)
- PrimaryPHP.net releases page, security advisory banner (21 Oct 2026)
- CoverageThe Record: Hundreds of websites taken offline as concern grows over two PHP vulnerabilities (21 Oct 2026)
- CoverageHackread: PHP Releases Emergency Fixes for Critical PHP2Shell Vulnerabilities (21 Oct 2026)
Why "Confirmed"? We label a story "Confirmed" when the company or government announced it itself. Spotted an error? Email hello@openloopnews.com and we will correct it.
