The flaws and the role of artificial intelligence
OpenAI made public on October 21 two critical vulnerabilities in PHP, the language that, according to estimates cited in the material, runs about 70% of websites. The flaws are catalogued as CVE-2026-109618 and CVE-2026-109619 and have a CVSS score of 9.2 out of 10. They concern memory management and, according to OpenAI’s account, allow remote code execution without authentication: the problem stems from the way PHP handles out-of-memory errors, which can leave an invalid internal state exploitable to read or corrupt data.
One of the two was identified by the security firm Calif using GPT-5.6 Sol as part of the Patch the Planet initiative; Wiz discovered both independently. The role of AI should be read with caution: Wiz says it used its own Wiz Atlas platform together with Google’s Gemini 4 Argon and GPT-5.6 Sol, and attributes to Gemini a role in discovery, exploit development, detection and patch validation. OpenAI’s announcement does not specify which of the two flaws Calif found, nor whether Wiz used AI models. The new element is therefore discovery assisted by advanced models, but the exact allocation of credit remains to be clarified.
Patches, versions identified and attacks underway
The PHP Foundation released the fixed versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and earlier versions do not receive official fixes and those using them must migrate. OpenAI also published an open-source tool to check the installed version, but it only compares version numbers and does not verify that the patch is actually applied.
The crux is timing. OpenAI speaks of a 'defender’s window,' the period in which advanced models serve to find and close holes before the same capabilities end up in attackers’ hands. On the same day, however, Cloudflare stated that the flaw had leaked and that its customers were already in the crosshairs. The material also reports warnings from governments around the world and some sites taken offline as a precaution. The disclosure, then, came when exploitation was already under way according to Cloudflare, while coordination had taken a long time.
Timing and the burden on maintainers
Calif began examining PHP on July 30 at the request of the PHP Foundation and on August 11 reported a remote execution path traceable to a 2024 bug; OpenAI says it reported the same defect the same day. About two months of coordination with maintainers, researchers and security vendors followed before disclosure.
OpenAI proposes a five-phase model for managing vulnerabilities discovered by AI and asks the security community to critique it. The company says these bugs are among many others already identified and predicts a marked increase in similar discoveries in the coming months. If this trend holds, volunteer maintainers of open-source projects will have to handle a much denser flow of reports, and a two-month embargo may not be enough: this is a prediction by the company, not a fact verified in the material. Still to be established are the exact attribution of the discoveries, the real scope of the attacks reported by Cloudflare and whether patches have actually been applied by users.
