Tooling12d ago
OpenAI Patch the Planet: GPT-5.6 Sol helped find two critical PHP RCE flaws, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
On Oct 21, PHP published a security advisory fixing two critical unauthenticated remote code execution flaws (CVE-2026-109618, CVE-2026-109619) affecting every PHP install serving web requests, with mod_php at highest risk. OpenAI disclosed the same day that Calif found a flaw using GPT-5.6 Sol under its Patch the Planet initiative, with Wiz independently finding and reporting both; OpenAI coordinated a two-month disclosure and committed $1B in subsidized Daybreak access for under-resourced defenders.
Security11d ago
OpenAI Discloses PHP Zero-Day Critical Flaws Found via GPT-5.6 Sol, Open-Sources Scanner and Pledges $1B Defense Fund
OpenAI announced a critical coordinated vulnerability disclosure in the core PHP runtime discovered by cybersecurity firm Calif utilizing GPT-5.6 Sol, alongside independent verification by Wiz. Because PHP powers roughly 70% of all websites globally, the vulnerability represented an existential risk to internet infrastructure. Following coordinated patching, OpenAI committed $1B in subsidized Daybreak security access and open-sourced openai/php2shell-checker, an automated Codex inspection tool enabling site administrators worldwide to audit their deployments.
Industry28d ago
Google pauses product-vulnerability payouts in its OSS VRP after a flood of automated AI submissions; $500–$7,500 band zeroed, update promised in Q1 2027
Google's Open Source Software Vulnerability Reward Program stopped accepting product-vulnerability reports on October 1, 2026, citing a significant rise in automated submissions that are mostly invalid. Commit f8bf23ad8 in google/bughunters (Sept 30) replaced the product-vulnerability reward bands ($500–$7,500 for flagship projects, $101–$3,133.7 for important ones) with dashes, while supply-chain compromise rewards stay at up to $31,337. Reports filed before Oct 1 are unaffected, some Google Cloud repos can route via Cloud VRP, and Google promises an update in Q1 2027.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.