The software quietly running a huge share of the internet just had a very close call. On October 21, 2026, OpenAI announced that its models helped uncover two critical vulnerabilities in the PHP engine.
The discovery came alongside researchers from Calif and Wiz. A fix was ready before attackers could weaponize the bugs.
The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS score of 9.2, placing them firmly in critical-risk territory.
What the researchers found
Both vulnerabilities open the door to remote code execution, or RCE. That means an attacker could potentially run their own commands on a server from somewhere else entirely.
The flaws also allow malicious memory disclosure, meaning an attacker could access sensitive data sitting in a server process’s memory.
No authentication is required. An attacker would not need a login, a stolen password or an inside contact to try it.
The bugs affect PHP versions going back to 5.4.0, so the flaws have been lurking in the codebase across many years of releases.
How the bugs work
The root cause sits in memory safety. The problems stem from how PHP handles out-of-memory situations and from stale global state that persists across requests.
The findings were credited to Calif, Wiz and OpenAI Codex Security. The RCE behavior was independently verified on WordPress and Drupal in August 2026.
Why the blast radius is so large
The vulnerabilities could potentially impact an estimated 70% of websites that rely on PHP. The list of exposed platforms includes WordPress, Drupal and MediaWiki.
The disclosure was coordinated with major infrastructure players, including AWS, Google Cloud and Microsoft.
The AI angle
OpenAI is framing the episode as an example of what it calls a “Defender’s Window.” The idea is that AI tools can surface flaws before malicious actors find and use them.
Codex Security is OpenAI’s security-focused tool. The credit is shared with Calif and Wiz researchers, who were part of the work.
What this means for website operators and the industry
For anyone running a PHP-based site, the practical takeaway is straightforward: update to the patched PHP versions. The research findings stress that operators of WordPress and Drupal installations face an urgent need to move.
The research findings warn that failure to remediate could lead to widespread security incidents, potentially undermining user trust and causing significant financial losses for affected businesses.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.