PHP Exposes Two High-Severity Vulnerabilities Rated 9.2; GPT-5.6 Sol Participated in Discovery

A catastrophic disaster, folks—the best language, PHP, has been hit by a major vulnerability!

Two extremely high-severity vulnerabilities have just been disclosed, both with danger scores reaching 9.2, the highest priority range.

In the worst case, an attacker can execute code on the server without logging in. Almost all versions starting from PHP 5.4 are affected (including the many 7.x and 8.0/8.1 versions still in use).

The official team has made it clear that there is no complete mitigation—the only safe course is to upgrade immediately.

The key point is that the official team stopped supporting PHP 8.1 and earlier versions long ago, so there's no patch to apply even if you want one, aaaah!

After all, PHP powers seven out of ten websites worldwide. Reuters says some government websites in the Netherlands, Finland and elsewhere have already been taken offline in advance to guard against possible attacks.

Japan is also working through the night... (you know what Japanese websites are like)

Amid all this chaos, guess what?

Hey, OpenAI is back at it again:

It turns out these two vulnerabilities, collectively called PHP2Shell, were first discovered by GPT-5.6 Sol.

OpenAI's exact words were:

The security company Calif used GPT-5.6 Sol to discover critical vulnerabilities in PHP. Wiz also independently discovered and reported these two vulnerabilities.

And OpenAI also played a leading role in the subsequent patch updates.

Once this post went up, everyone's reaction was like:

Also, let me highlight a key point. In OpenAI's announcement, it wrote that this major PHP vulnerability outbreak is "just a fraction of the many major vulnerabilities we have already discovered and are working to fix."

OpenAI expects the number of similar vulnerabilities to surge sharply in the coming months...

GPT discovers super vulnerabilities

Before going into detail, let me give everyone a reminder.

The two vulnerabilities are numbered CVE-2026-109618 and CVE-2026-109619.

CVE-2026-109618: An out-of-memory (OOM) condition leads to incomplete internal data structures; when cleaning up a request, invalid data is treated as valid, which can cause memory corruption and RCE (remote code execution).

CVE-2026-109619: Request-related global state remains after memory is freed; subsequent requests handled by the same worker use the freed memory (use-after-free), which can likewise lead to RCE.

The official fixed versions already released include:

PHP 8.5.12, PHP 8.4.27, PHP 8.3.36 and PHP 8.2.35.

All PHP deployment environments that handle web requests are at risk, including PHP-FPM, Apache with the mod_php module, php-cgi, FrankenPHP and LiteSpeed. Among them, mod_php carries the highest risk.

Researchers have already reproduced unauthenticated remote code execution on some WordPress, Drupal and Joomla deployments.

So how did GPT-5.6 Sol discover these two vulnerabilities?

In June 2026, OpenAI launched an open-source security initiative called "Patch the Planet."

The core goal of this plan is to use AI to help discover vulnerabilities in open-source projects, while also addressing a new problem brought by AI: models can find vulnerabilities in large numbers, but open-source maintainers are severely understaffed and can easily be overwhelmed by a flood of reports. So AI must not only find bugs but also debug them.

The security company Calif is one of OpenAI's initiative partners. It was precisely under the Patch the Planet framework that Calif discovered one of the key issues in this PHP super vulnerability.

Meanwhile, another well-known security company, Wiz Research, also independently discovered and reported the related vulnerabilities. Wiz also used AI in its research process, including Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. Among them, Gemini 4 Argon played an "indispensable role" in vulnerability discovery, exploit development, attack detection and patch verification.

So over the past two months, OpenAI led the coordination with PHP maintainers, Wiz, Cloudflare and others to prepare patches and mitigations, and then just now publicly disclosed the issue and released the fixed versions.

(The long timeline was mainly because the fix involves the underlying PHP engine and the changes are relatively extensive.)

In OpenAI's own words, this time frontier AI opened a "defender's window" for maintainers and security vendors before attackers could act.

It is worth noting that OpenAI warns that this vulnerability is significant, but it is only the beginning...

They are just a fraction of the many major vulnerabilities we have already discovered and are working to fix. We expect the number of similar vulnerabilities to surge sharply in the coming months.

As Wiz put it, AI lowers the barrier to exploiting complex vulnerabilities, and it can also help defenders discover and fix vulnerabilities.

For the full vulnerability reports, see the PHP announcement and the Wiz report:

This article is from the WeChat public account "Quantum Bit," author: Yu Yang, published by 36Kr with authorization.