Openai Patch The Planet

AI-discovered PHP bugs expose scale of new RCE threat

Security researchers at Calif (working with OpenAI's Patch the Planet program) and Wiz (owned by Google Cloud) independently found two critical remote code execution vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Both teams used frontier AI models, including GPT-5.6 Sol and Gemini 4 Argon, to identify the flaws and build working exploits. One of the bugs had actually been flagged in a 2024 PHP Foundation audit funded by the Sovereign Tech Agency, but was left unpatched because no one could devise a practical exploit at the time.

drew.silcock.dev · 2026-10-23

OpenAI's GPT-5.6 Sol AI model finds critical PHP flaws, patches now released

OpenAI says researchers using its GPT-5.6 Sol model under the 'Patch the Planet' program discovered critical vulnerabilities in PHP, the language that powers roughly 70% of websites. The PHP Foundation has issued patched versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, though older PHP 8.1 and earlier releases won't be fixed. The coordinated disclosure was moved up a day to Oct. 21 after some details leaked publicly on Oct. 20.

tomshardware.com · 2026-10-22