# OpenAI’s GPT-5.6 Sol Helps Find Two Critical Flaws in PHP

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/37373
Published: 2026-10-22T03:04:55.000Z
Updated: 2026-10-22T03:04:55.000Z
Section: Technology

> PHP maintainers issued fixed releases, while OpenAI pledged $1 billion in subsidized Daybreak access for frontline defenders.

OpenAI’s GPT-5.6 Sol helped identify two critical flaws in PHP, prompting emergency patches for software used across much of the web, including services relied on by crypto businesses.

The vulnerabilities, grouped under the name PHP2Shell, are unauthenticated remote code execution flaws in PHP’s core engine. They affect internet-facing deployments such as PHP-FPM and mod_php; mod_php is the higher-risk configuration. The flaws carry identifiers CVE-2026-109618 and CVE-2026-109619. Wiz independently identified and disclosed the two vulnerabilities.

PHP maintainers released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier no longer receive official updates, though some distributors and long-term support providers may offer fixes for older versions.

The disclosure followed about two months of coordination among maintainers, researchers and security companies. Cloudflare deployed web application firewall rules in early October and observed attempted attacks before public disclosure.

OpenAI also pledged $1 billion in subsidized access to its Daybreak program for frontline defenders, targeting organizations with limited resources that protect critical services. PHP is estimated to power about 70% of websites. Cloudflare described firewall rules as an interim defense while patched PHP releases provide the lasting fix.