What happened
OpenAI said its GPT-5.6 Sol identified the critical PHP flaw as part of its Patch the Planet initiative; security firm Calif used it for the find, and Google-owned Wiz independently found and reported both vulnerabilities.
Why it matters
The flaw's severity and PHP's wide use make it "one of the most impactful security issues in recent years" by OpenAI's account, and OpenAI warns the same AI capability could speed attackers' exploit development.
WHO IT HITSOperations and security teams running PHP-based services face priority patching, and OpenAI is offering a PHP version checker plus a planned Codex skill to help them identify exposed versions and decide which updates to apply.
Summaries like this, in your inbox every morning.
The disclosure lands alongside a practical disruption: many internet services at home and abroad stopped around the 11pm security update on the 21st, as operators moved to apply fixes for the PHP flaw. OpenAI frames the find as one of several critical vulnerabilities it has already identified and is working to fix, and it expects similar discoveries to surge in the coming months — a pace that explains its push for a shared approach.
That approach is being assembled from several directions at once. PHP's maintainers led the fix and release, while OpenAI's team worked with Wiz, Cloudflare and other partners on investigation, technical support and coordination to prepare protections ahead of publication. Calif's use of GPT-5.6 Sol came under Patch the Planet, one of the initiatives OpenAI cites.
OpenAI's stated worry is symmetric: the same capability that helps defenders can also speed attackers' development of attack tools and exploits. Alongside the version checker and planned Codex skill, it points to support such as Daybreak for Frontline Defenders as a way to put frontier models in more defenders' hands, and it is asking the security community to improve and cooperate on the framework it plans to share.
Pick your industry and the AI tools you use, and get news related to your work every day.
Free · 30 seconds with Google · unsubscribe anytimeWhat is AIToday? →
Ask AI anything about this article. The AI reads this article, earlier AIToday articles, and Wikipedia, and cites its sources. Q&As are published on this page for other readers too.
At GTC Berlin, Jensen Huang introduced DSX POD — seven Vera Rubin NVL72 racks per container — and said deploym…
Opposable launched an AI agent that operates Android phones via accessibility services and iPhones through a c…
On Meta's third quarter earnings call, CEO Mark Zuckerberg said the company has a goal of serving billions of…
OpenAI's GPT-5.6 Sol tracked down the PHP flaw under Patch-the-Planet, and Wiz independently found the same is…
The PHP Foundation disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively c…
A tech fund has developed an AI agent that detects security vulnerabilities, per Nikkei's technology coverage
