OpenAI disclosed two critical memory-safety vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale. Exploiting them could enable unauthenticated remote code execution, allowing attackers to take control of vulnerable PHP servers. Fixes were released on October 21, 2026, for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, after approximately two months of work. OpenAI also released the php2shell-checker tool, which assesses exposure without sending exploit traffic to the target, while its Codex agent can identify vulnerable website versions. The flaws were found through OpenAI’s Patch the Planet initiative, which says this was the first public case of advanced AI identifying vulnerabilities at internet scale before they could be exploited.
Source: Read the original article
