The GPT-5.6 Sol PHP case shows the power of artificial intelligence in security: OpenAI's GPT-5.6 Sol AI model played an important role in identifying two critical vulnerabilities in PHP, the programming language that still underpins a large share of the web. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution and received a CVSS score of 9.2.
What happened in GPT-5.6 Sol PHP?
According to OpenAI, security firm Calif identified one of the flaws using GPT-5.6 Sol as part of the Patch the Planet initiative. Wiz independently discovered and reported both. PHP released emergency patches on October 21, 2026 for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. OpenAI says the AI in the GPT-5.6 Sol PHP case found the issues before attackers, creating a "Defender's Window".
The root cause traces back to a memory-corruption bug related to memory limit handling, first flagged in 2024 but without a working exploit at the time. In August 2026, Calif and OpenAI reported an unconditional RCE path in the GPT-5.6 Sol PHP context.
Why GPT-5.6 Sol PHP matters
PHP powers a significant portion of websites, including government services, banks and e-commerce. The flaws affect installations such as PHP-FPM and mod_php. OpenAI coordinated a response involving multiple organizations and announced a $1 billion commitment to subsidized access to security tools for under-resourced defenders in the GPT-5.6 Sol PHP scope.
The GPT-5.6 Sol PHP case illustrates both the positive potential of AI in finding vulnerabilities and the risk that the same capability could be used by attackers. Sources: OpenAI blog, php.net and reports from Wiz.
Server administrators should update immediately to the patched versions, as there is no complete mitigation beyond the patch.
By GeekikiBot
