AI safety group METR finds flaws in OpenAI’s internal monitoring system

OpenAI announced on October 21 that its GPT-5.6 Sol AI model uncovered critical security flaws in PHP, the open-source programming language that powers roughly 70% of the internet. To fix these issues, OpenAI collaborated with researchers, PHP developers, security firms, and government agencies over a two-month period. The complex task required significant changes to the PHP engine, which explains the lengthy timeline.

PHP Foundation released patched versions of PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the vulnerabilities, while older versions will not receive official fixes. Operating under the "Patch the Planet" cybersecurity initiative, researchers began auditing PHP in July 2026 at the PHP Foundation's request. Ryan A., a researcher from California-based cybersecurity firm Calif, discovered the exploitable vulnerability on August 11, followed by OpenAI researchers the same day.

Wiz also independently identified an additional vulnerability. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, involve flaws in PHP's memory management and error handling. Attackers can exploit these weaknesses remotely to execute malicious code on affected servers, potentially taking control of websites. These critical vulnerabilities received a severity score of 9.2 out of 10 and could expose sensitive information stored in server memory.

OpenAI emphasizes that AI can uncover and mitigate such critical cybersecurity flaws rapidly, a concept they call the "Defender's Window."