OpenAI said Calif used its GPT-5.6 Sol model to find one of two critical PHP vulnerabilities that Wiz researchers independently discovered. PHP maintainers led the patching effort, and patches for CVE-2026-109618 and CVE-2026-109619 were released on Oct. 21, 2026.
The FBI warned that the flaws could allow remote code execution in PHP core and urged organizations to update affected installations immediately. It recommended taking affected systems offline if an immediate update was not feasible. CZ said vulnerability details leaked prematurely and real-world exploitation was confirmed almost immediately after disclosure.
