What happened
Calif used GPT-5.6 Sol to uncover the critical PHP vulnerability PHP2Shell (CVE-2026-109618/CVE-2026-109619), and the PHP team shipped a fix patch at 23:00 JST on October 21.
Why it matters
The flaw was found before attackers could exploit it, giving defenders time to prepare fixes and defenses ahead of any attack.
WHO IT HITSSystem administrators and DevOps teams running PHP-based applications should check their PHP versions and apply the patch promptly, as the vulnerability was deemed critical.
Summaries like this, in your inbox every morning.
OpenAI's Patch the Planet initiative, launched in June, aims to use AI to find and fix vulnerabilities in open-source software before they can be exploited. This incident marks a notable success for that approach: according to OpenAI, it is the first time a frontier AI has discovered a vulnerability before attackers. The finding was independently corroborated by Wiz Research, which also discovered and reported the flaw.
OpenAI is now emphasizing patch adoption as the top priority. It has released a PHP version checker as a Codex skill so that operators can determine whether their PHP versions are vulnerable and decide on necessary updates in line with guidance from PHP and their vendors.
Looking ahead, OpenAI has pledged $1 billion in grants for Daybreak through Daybreak for Frontline Defenders, aiming to enable more defenders to use such capabilities. The company also calls for collaboration to improve this approach.
Pick your industry and the AI tools you use, and get news related to your work every day.
Free · 30 seconds with Google · unsubscribe anytimeWhat is AIToday? →
Ask AI anything about this article. The AI reads this article, earlier AIToday articles, and Wikipedia, and cites its sources. Q&As are published on this page for other readers too.
Anthropic used Claude to analyze 25 open-source projects (over 5 million lines) and found 493 issues, includin…
Canadian Imperial Bank of Commerce found that its most powerful models, including Anthropic's Opus, can cost $…
The author details a setup where Claude Code reads an entry document called CLAUDE.md, writes results into rol…
Google opened Gemini 4 Argon to the public on October 13, 2026, after a September 30 announcement limited at f…
Using atopile, KiCad, Freerouting and Claude Code, the developer automated circuit description, placement, rou…
OpenAI published 719 write-ups of math results, but its changelog says only 300 / 719 (about 42%) were verifie…
