Two critical bugs in the core PHP runtime became public on October 21, 2026, together with patched releases and an unusual account of how they were found. OpenAI says the security firm Calif discovered one of the flaws with GPT-5.6 Sol through OpenAI's Patch the Planet program, while Wiz independently found and reported both. OpenAI then spent about two months coordinating maintainers, researchers and infrastructure companies so that fixes and protections were ready before disclosure.
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. According to the PHP project's advisory, the first lets an out-of-memory condition interrupt PHP while request data is half built, so cleanup code later treats broken data as valid. The second leaves request-owned state alive after its memory is freed, which a later request on the same worker can pick up. PHP says both can allow unauthenticated remote code execution and rates mod_php as the highest-risk setup, citing a working exploit that fires before any application code runs. Google Cloud reports a CVSS score of 9.2 for each.
Fixed builds are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Google Cloud lists every release from 5.4 through 8.5.11 as affected. PHP 8.1 and older are past end of life, although the PHP security team published minimal source backports for 7.4, 8.0 and 8.1 because of the severity, and Linux distributions received patches ahead of time. The advisory also describes interim settings, such as memory and upload limits and disabling session upload progress, while stressing that only an update fully closes the holes. Reuters reported that an EU agency warned some websites might need to go offline while patches were prepared.
OpenAI ranks the bugs among the most consequential security problems it has seen lately and frames the episode as a test of how defenders should respond when AI finds serious flaws at scale. Its post sets out five stages: validating and fixing the upstream bug, including adversarial testing with frontier models; giving affected organizations time to act; working with governments; preparing updates across products; and publishing guidance. For PHP, OpenAI says it engaged the Super Intelligence Force at the White House, the Office of the National Cyber Director and CISA, along with partners such as Wiz and Cloudflare.
The company paired the disclosure with money and tooling. It says it has committed $1 billion in subsidized access to Daybreak, its security product, through a program aimed at under-resourced organizations protecting essential services, and it published a Codex skill that tells operators which PHP versions they run. OpenAI also says it is tuning extra blocking classifiers on Daybreak to limit misuse, while acknowledging that such filters can block legitimate security research.
OpenAI warns that these bugs are among several serious vulnerabilities it has already found and that similar findings should rise sharply in coming months. It is asking the security community for feedback on open questions, including how long disclosure windows should be, who deserves early notice, and whether governments or operators should ever patch systems they have lost control of.
Several points rest on OpenAI's own account. The claim that AI found the flaws before attackers did is stated only to the company's knowledge, and the precise split of credit between Calif's model-assisted work and Wiz's independent research is not detailed. The proposed framework is a draft for comment, not an adopted standard, and the $1 billion figure describes subsidized access rather than cash grants.