12:46 PM ET · Oct 21

Critical PHP flaws found with OpenAI's GPT-5.6 Sol knock websites offline as defenders race to patch

Researchers at security firm Calif used OpenAI's GPT-5.6 Sol to find two critical flaws in PHP's core runtime (CVE-2026-109618 and CVE-2026-109619), which Wiz also found independently and which allow unauthenticated remote code execution on PHP 5.4 through 8.5.11, the language behind an estimated 70% of websites. After details leaked ahead of disclosure, the NSA and allied cyber agencies urged operators to patch or take sites offline, and government and media sites went down Wednesday as PHP shipped fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. OpenAI called it "one of the most impactful security issues in recent memory," and Cloudflare says early attacks are already emerging.

Source: Business Insider

Also covering this story

On X

OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
— OpenAI (@OpenAI) Oct 21, 2026

Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory, php2shell, found as part of our Patch the Planet initiative.
— Greg Brockman (@gdb) Oct 21, 2026

PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free. We are seeing early attacks emerging and are updating mitigations as new vectors show
— Dane Knecht 🦭 (@dok2001) Oct 21, 2026

Back to The Wire · Subscribe

Critical PHP flaws found with OpenAI's GPT-5.6 Sol knock websites offline as defenders race to patch

Also covering this story

On X

Know what matters in AI.