PHP patches two critical flaws, one found with OpenAI's GPT-5.6 Sol

PHP issued emergency patches on 21 October for two critical vulnerabilities that could let an attacker run code on a vulnerable server, according to a PHP security advisory.

PHP said every installation serving web requests could be exposed. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Neither requires login credentials to exploit.

PHP released patches for supported versions. Older, unsupported releases face a harder upgrade path, according to the notes on the advisory.

Finland temporarily shut down government web services in response. Edinburgh council and the BBC took pages offline.

Security agencies advised organisations that could not patch quickly to isolate vulnerable systems.

OpenAI said a critical flaw was identified using its GPT-5.6 Sol model. Wiz independently found both vulnerabilities. OpenAI described the process in a coordinated disclosure post.

OpenAI called the gap between AI-assisted discovery and public disclosure a "Defender's Window," in which maintainers can patch before attackers gain the same capabilities.

These details come from a secondary summary by The Neuron. The OpenAI and PHP pages have not been read directly. Operators of PHP servers are advised to apply the patches or isolate affected systems.