🇯🇵 Japanese, 21 October 2026, open-source-security
OpenAI Discovers Critical PHP Vulnerabilities Using AI
OpenAI's AI model GPT-5.6 Sol identified two critical vulnerabilities in PHP, one of the most widely used open-source software.
OpenAI led the response to the vulnerabilities, which were discovered using the company’s AI model GPT-5.6 Sol. The model was used in collaboration with security company Calif. The vulnerabilities were reported to PHP maintainers before being publicly disclosed. The company stated that the vulnerabilities are among the most impactful security issues in recent years, considering PHP’s widespread use.
The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have a CVSS v4.0 score of 9.2. The patches, PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, were released on October 21. OpenAI has urged users to apply the patches as soon as possible and has provided a tool to check for affected PHP versions.
The discovery highlights the potential for AI to identify vulnerabilities that may have gone unnoticed for years. However, it also raises concerns about the potential for AI to accelerate the development of attack tools.