{"slug": "openais-gpt-5-6-sol-helped-flag-the-critical-php-bug-flaw-thats-had-the-internet", "title": "OpenAI’s GPT-5.6 Sol Helped Flag The Critical PHP Bug Flaw That’s Had The Internet Scrambling", "summary": "OpenAI confirmed that its GPT-5.6 Sol model helped surface one of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS and patched by PHP on October 21 after details leaked online. OpenAI said security firm Calif identified the flaw using GPT-5.6 Sol under its Patch the Planet program, reporting it on August 11, 2026, the same day OpenAI independently reported the identical issue; Wiz separately discovered and reported both vulnerabilities. OpenAI also announced a $1 billion commitment to subsidized access to its Daybreak security tooling for under-resourced defenders and described a five-stage coordinated-response model it used with CISA, the Office of the National Cyber Director, and the White House's Super Intelligence Force.", "body_md": "OpenAI has confirmed that its GPT-5.6 Sol model played a role in surfacing one of the two critical PHP vulnerabilities that triggered an emergency patch, a wave of government warnings, and precautionary website shutdowns around the world this week. In a blog post titled “Patch the Planet: global response coordination as agents uncover critical vulnerabilities,” OpenAI says security firm Calif “identified a critical flaw using GPT‑5.6 Sol” as part of the company’s Patch the Planet initiative — with security firm Wiz separately and independently discovering and reporting both vulnerabilities on its own.\n\nThe [two bugs in question](https://officechai.com/stories/php-rushes-out-emergency-patch-for-two-critical-flaws-after-vulnerability-details-leak-online/), CVE-2026-109618 and CVE-2026-109619, both carry a 9.2 CVSS severity score and can let an unauthenticated attacker remotely execute code on servers running PHP — the language that still underpins a large share of the web, including government services, banks, and e-commerce platforms. PHP shipped emergency patches for both on October 21, prompting Japan’s Prime Minister and, by some accounts, the FBI’s cyber division to publicly urge organizations to update immediately or take exposed systems offline.\n\n## How OpenAI Helped Find The PHP Vulnerability\n\nAccording to the PHP Foundation, the underlying root-cause issue — a memory-corruption bug tied to how PHP handles requests that hit its memory limit — was actually first flagged in 2024, during PHP’s first external security audit, funded by Germany’s Sovereign Tech Agency and carried out by the security firm Quarkslab. A human PHP core developer, contracted by the Foundation, spotted the first warning signs of that bug while fixing an unrelated issue Quarkslab had reported. At the time, no one could find a way to turn it into a working exploit, so the issue sat unresolved for roughly two years.\n\nIt wasn’t until August 11, 2026 — as part of a security audit under OpenAI and Calif’s “Patch the Planet” program — that Calif’s researcher reported an unconditional remote-code-execution path tracing back to that same 2024 root cause. Critically, OpenAI says it independently reported the identical issue on the very same day, and the PHP Foundation’s own account confirms this: both Calif and OpenAI flagged the same underlying flaw on August 11, with Wiz contributing further attack vectors shortly after.\n\n## What OpenAI is proposing next\n\nBeyond the PHP incident itself, OpenAI used the post to lay out a broader framework for how it wants AI-assisted vulnerability research to be handled going forward, especially as it expects “similar findings to increase sharply in the coming months.” The company described a five-stage coordinated-response model — validating and fixing the upstream bug, giving affected organizations advance time to prepare, coordinating with government agencies (OpenAI says it engaged the White House’s Super Intelligence Force, the Office of the National Cyber Director, and CISA on the PHP response), rolling out updates across affected products, and finally publishing public guidance once a patch ships.\n\nOpenAI also announced a $1 billion commitment to subsidized access to its Daybreak security tooling for under-resourced defenders, under a program it’s calling “Daybreak for Frontline Defenders,” alongside existing support such as free Codex subscriptions for open-source maintainers and direct sponsorship of projects like the Rust Foundation.\n\nThe company was candid about the double edge of this work: the same AI capability that let Calif and OpenAI surface the PHP flaw before attackers could, it said, “can also help attackers rapidly develop offensive tools and exploits.” OpenAI says it believes frontier AI found these particular bugs before any attacker did, giving defenders what it called a “Defender’s Window” to prepare fixes ahead of public disclosure — though, as this week’s leak and an embargo break by a container-image provider showed, that window can close faster than anyone plans for.", "url": "https://wpnews.pro/news/openais-gpt-5-6-sol-helped-flag-the-critical-php-bug-flaw-thats-had-the-internet", "canonical_source": "https://officechai.com/ai/openais-gpt-5-6-sol-helped-flag-the-critical-php-bug-flaw-thats-had-the-internet-scrambling/", "published_at": "2026-10-21 15:52:05+00:00", "updated_at": "2026-10-21 16:10:36.865417+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "large-language-models", "ai-agents"], "entities": ["OpenAI", "GPT-5.6 Sol", "PHP", "Calif", "Wiz", "PHP Foundation", "CISA", "Daybreak"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/openais-gpt-5-6-sol-helped-flag-the-critical-php-bug-flaw-thats-had-the-internet", "markdown": "https://wpnews.pro/news/openais-gpt-5-6-sol-helped-flag-the-critical-php-bug-flaw-thats-had-the-internet.md", "text": "https://wpnews.pro/news/openais-gpt-5-6-sol-helped-flag-the-critical-php-bug-flaw-thats-had-the-internet.txt", "jsonld": "https://wpnews.pro/news/openais-gpt-5-6-sol-helped-flag-the-critical-php-bug-flaw-thats-had-the-internet.jsonld"}}