OpenAI's GPT-5.6 Sol finds critical PHP flaws CVE-2026-109618, CVE-2026-109619

The discovery comes as AI is increasingly used on both sides of cybersecurity: attackers seek to scale attacks, while defenders use AI to find flaws. In this case, OpenAI's GPT-5.6 Sol identified the PHP vulnerabilities in August, and PHP Foundation released patches on October 21. The body notes that prior to the official patch, some attackers attempted to exploit the widely reported flaws, and Cloudflare's CTO said early-stage attacks were already observed. The disclosure also prompted government agencies in the Netherlands and Finland to take sites offline, and the FBI and NSA issued statements urging updates, with Japan's Prime Minister Sanae Takaichi and EU authorities also issuing alerts. Whether patching can outpace exploitation remains uncertain, the body says.