OpenAI Patch the Planet: GPT-5.6 Sol helped find two critical PHP RCE flaws, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35

Background and the pain point

PHP still powers a large share of websites and web apps; OpenAI's post puts it at roughly 70% of sites. Once an infrastructure-level flaw goes public, attackers often move faster than operators. As frontier models get better at finding bugs, the question shifts from whether a flaw can be found to whether fixes reach distributions, hosts and operators before attackers do.

Architecture and mechanism

Per PHP's advisory, CVE-2026-109618 lets out-of-memory handling interrupt PHP while request data is only partially initialized, and request cleanup then treats the invalid data as valid. CVE-2026-109619 lets request-owned internal state survive after its memory is freed, so a later request on the same worker may use it before initialization. Both allow unauthenticated remote code execution. Per OpenAI's blog, Calif found a flaw using GPT-5.6 Sol under Patch the Planet, and Wiz independently found and reported both. PHP maintainers led the fix, while OpenAI, Wiz, Cloudflare and others coordinated for about two months, including early protections with distributors, security vendors and US agencies such as ONCD and CISA.

Benchmarks

This is a security event, not a model launch: no model benchmarks or discovery-rate figures were published. The verifiable facts are that PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed are affected, and mod_php has a demonstrated exploit where an unauthenticated request triggers the attack before any application code runs. OpenAI calls it one of the most impactful security issues in recent memory; that is the vendor's characterization.

Getting started

Upgrade now to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35; distributions and LTS vendors received patches in advance, so check for updated packages. PHP 8.1 and older are unsupported, but the security team published minimal source backports for 7.4, 8.0 and 8.1. If you cannot upgrade yet, PHP suggests memory_limit=-1 via php_admin_value, a low post_max_size and request-size limits at the web server or proxy, none of which makes an install safe. OpenAI is also sharing a PHP version checker and will ship a matching Codex skill.