OpenAI's GPT-5.6 Sol Exposes Critical Flaws in PHP

An estimated 70% of the internet's websites run on PHP, a widely used programming language. According to a press release from OpenAI dated October 21, 2026, that vast digital infrastructure was exposed to two critical security flaws. The company stated that researchers using its GPT-5.6 Sol model uncovered these vulnerabilities as part of its "Patch the Planet" cybersecurity initiative. Following the discovery, OpenAI coordinated a group that included researchers, PHP maintainers, security providers, and government cybersecurity agencies to issue a fix over a two-month period, a timeline the company attributed to the complexity of the required changes to the PHP engine.

The timeline for addressing this issue began in 2024, when the PHP Foundation first became aware of an underlying flaw in its code. For two years, the organization was unable to determine a method for exploiting the issue or how to properly fix it. The process was formally initiated on July 30, 2026, when researchers from Calif, a California-based cybersecurity firm and the founding partner of the "Patch the Planet" program, began an audit at the foundation's request.

The breakthrough came on August 11, 2026, when a Calif researcher identified an exploitable vulnerability. OpenAI's own researchers confirmed this finding the same day. Subsequently, another firm, Wiz, independently identified an additional vulnerability. These two issues, designated CVE-2026-109618 and CVE-2026-109619, were both given a critical severity score of 9.2 out of 10. One involves how the language manages computer memory when it runs out of space, while the other relates to a fatal error leaving the system pointing to memory that has already been freed. Under certain conditions, these flaws could be exploited remotely without login credentials to execute malicious code on affected servers.

The vulnerabilities are located within PHP's core engine, meaning websites could be affected even if their own application code had no security flaws. The flaws could also expose sensitive information held in server memory, such as passwords, authentication tokens, and API keys. OpenAI's model demonstrated practical ways to exploit these issues within two weeks, a stark contrast to the two years human developers and security teams were unable to fully resolve them.

Following premature disclosures about the flaws on October 20, 2026, which led to public outcry, the coordinated release of patched versions was moved forward from its originally scheduled date of October 22. The PHP Foundation has now released fixed versions: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Older versions of PHP, specifically 8.1 and earlier, will not receive official fixes. OpenAI advises that every site using PHP can now upgrade to a patched version to remain secure.

OpenAI considers this incident one of the biggest cybersecurity discoveries of 2026 and an example of a concept it calls the "Defender's Window." The company introduced this idea after its models hacked Hugging Face, and it describes a critical, narrow timeframe during which organizations can use advanced AI models to find and patch weaknesses before those same capabilities become available to malicious actors. OpenAI maintains that it is a collective responsibility to act proactively against such potential threats, citing a recent instance where Anthropic's Claude Mythos identified "thousands of zero-day vulnerabilities" across major operating systems and web browsers.