OpenAI’s Codex Security helps uncover two critical PHP flaws before attackers do

OpenAI announced on October 21, 2026 that its Codex Security tool, working with researchers from Calif and Wiz, helped uncover two critical remote code execution vulnerabilities in the PHP engine tracked as CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. The flaws, which require no authentication, stem from memory-safety issues in PHP's handling of out-of-memory situations and stale global state, and affect PHP versions back to 5.4.0, potentially exposing an estimated 70% of PHP-reliant websites including WordPress, Drupal and MediaWiki. Patches were ready before attackers could weaponize the bugs, and the disclosure was coordinated with AWS, Google Cloud and Microsoft; OpenAI framed the episode as a "Defender's Window" in which AI tools surface flaws before malicious actors exploit them.

OpenAI official logo public domain, Wikimedia Commons — CryptoBriefing brand treatment OpenAI’s Codex Security helps uncover two critical PHP flaws before attackers do OpenAI, Calif and Wiz disclosed two remote code execution bugs in the PHP engine that could reach an estimated 70% of PHP-reliant websites The software quietly running a huge share of the internet just had a very close call. On October 21, 2026, OpenAI https://cryptobriefing.com/markets/openai/ announced that its models helped uncover two critical vulnerabilities in the PHP engine. The discovery came alongside researchers from Calif and Wiz. A fix was ready before attackers could weaponize the bugs. The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619 . Both carry a CVSS score of 9.2, placing them firmly in critical-risk territory. What the researchers found Both vulnerabilities open the door to remote code execution, or RCE. That means an attacker could potentially run their own commands on a server from somewhere else entirely. The flaws also allow malicious memory disclosure, meaning an attacker could access sensitive data sitting in a server process’s memory. No authentication is required. An attacker would not need a login, a stolen password or an inside contact to try it. The bugs affect PHP versions going back to 5.4.0, so the flaws have been lurking in the codebase across many years of releases. AI, tech, and the markets they move—in one daily briefing. Daily. Free. Join 34,000+ readers across crypto, finance, and policy. How the bugs work The root cause sits in memory safety. The problems stem from how PHP handles out-of-memory situations and from stale global state that persists across requests. The findings were credited to Calif, Wiz and OpenAI Codex Security. The RCE behavior was independently verified on WordPress and Drupal in August 2026. Why the blast radius is so large The vulnerabilities could potentially impact an estimated 70% of websites that rely on PHP. The list of exposed platforms includes WordPress, Drupal and MediaWiki. The disclosure was coordinated with major infrastructure players, including AWS, Google Cloud and Microsoft https://cryptobriefing.com/markets/microsoft/ . The AI angle OpenAI is framing the episode as an example of what it calls a “Defender’s Window.” The idea is that AI tools can surface flaws before malicious actors find and use them. Codex Security is OpenAI’s security-focused tool. The credit is shared with Calif and Wiz researchers, who were part of the work. What this means for website operators and the industry For anyone running a PHP-based site, the practical takeaway is straightforward: update to the patched PHP versions. The research findings stress that operators of WordPress and Drupal installations face an urgent need to move. The research findings warn that failure to remediate could lead to widespread security incidents, potentially undermining user trust and causing significant financial losses for affected businesses. Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy https://cryptobriefing.com/editorial-policy/ .