# PHP patches two critical flaws, one found with OpenAI's GPT-5.6 Sol

> PHP issued emergency patches for two critical remote code execution flaws, one identified using OpenAI's GPT-5.6 Sol.

*The vulnerabilities allow remote code execution without login credentials and prompted Finland, Edinburgh council and the BBC to take services or pages offline.*

By Bez · WireRead
Canonical: https://wireread.com/news/php-patches-two-critical-flaws-one-found-with-openai-s-gpt-5-6-sol

PHP issued emergency patches on 21 October for two critical vulnerabilities that could let an attacker run code on a vulnerable server, according to a [PHP security advisory](https://www.php.net/archive/2026.php#2026-10-21-5).

PHP said every installation serving web requests could be exposed. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Neither requires login credentials to exploit.

PHP released patches for supported versions. Older, unsupported releases face a harder upgrade path, according to the notes on the advisory.

Finland temporarily shut down government web services in response. Edinburgh council and the BBC took pages offline.

Security agencies advised organisations that could not patch quickly to isolate vulnerable systems.

OpenAI said a critical flaw was identified using its GPT-5.6 Sol model. Wiz independently found both vulnerabilities. OpenAI described the process in a [coordinated disclosure post](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/).

OpenAI called the gap between AI-assisted discovery and public disclosure a "Defender's Window," in which maintainers can patch before attackers gain the same capabilities.

These details come from a secondary summary by The Neuron. The OpenAI and PHP pages have not been read directly. Operators of PHP servers are advised to apply the patches or isolate affected systems.

## Key takeaways

- CVE-2026-109618 and CVE-2026-109619 allow code execution without login credentials.
- Finland shut government web services; Edinburgh council and the BBC removed pages.
- Wiz independently found both flaws; OpenAI said GPT-5.6 Sol identified one.

## Sources

- [Coordinated disclosure of critical vulnerabilities](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/) — OpenAI, 2026-10-22
- [PHP security advisory](https://www.php.net/archive/2026.php#2026-10-21-5) — PHP.net, 2026-10-21