{
  "id": 16029902,
  "title": "OpenAI says ChatGPT Sol helped uncover critical PHP flaws that could affect 70% of websites",
  "url": "https://urgent.news/2026/10/22/openai-says-chatgpt-sol-helped-uncover-critical-php-flaws-that-could",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-22T10:30:00.000Z",
  "source": {
    "name": "Tom's Hardware",
    "slug": "tom-s-hardware",
    "url": "https://www.tomshardware.com/tech-industry/cyber-security/openai-says-gpt-5-6-sol-helped-uncover-critical-php-flaws-that-could-affect-70-percent-of-websites-ai-assisted-researchers-turned-two-year-old-bug-that-stumped-human-developers-into-working-exploits-in-two-weeks"
  },
  "original_language": "en",
  "account": "OpenAI announced on October 21 that its GPT-5.6 Sol AI model uncovered critical security flaws in PHP, the open-source programming language that powers roughly 70% of the internet. To fix these issues, OpenAI collaborated with researchers, PHP developers, security firms, and government agencies over a two-month period. The complex task required significant changes to the PHP engine, which explains the lengthy timeline. PHP Foundation released patched versions of PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the vulnerabilities, while older versions will not receive official fixes. Operating under the \"Patch the Planet\" cybersecurity initiative, researchers began auditing PHP in July 2026 at the PHP Foundation's request. Ryan A., a researcher from California-based cybersecurity firm Calif, discovered the exploitable vulnerability on August 11, followed by OpenAI researchers the same day. Wiz also independently identified an additional vulnerability. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, involve flaws in PHP's memory management and error handling. Attackers can exploit these weaknesses remotely to execute malicious code on affected servers, potentially taking control of websites. These critical vulnerabilities received a severity score of 9.2 out of 10 and could expose sensitive information stored in server memory. OpenAI emphasizes that AI can uncover and mitigate such critical cybersecurity flaws rapidly, a concept they call the \"Defender's Window.\"",
  "summary": "OpenAI says researchers using GPT-5.6 Sol uncovered two critical PHP vulnerabilities with severity scores of 9.2 and demonstrated working exploits, after which the company coordinated fixes.",
  "key_points": [
    "OpenAI's GPT-5.6 Sol AI discovered critical PHP security flaws",
    "Collaboration with researchers, developers, and agencies took two months",
    "PHP Foundation released patched versions to address vulnerabilities"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}