OpenAI Identifies Critical PHP Vulnerabilities, Urges Immediate Updates for Web Operators

On October 21, 2026, OpenAI announced the discovery of two critical vulnerabilities in the PHP engine, tracked as CVE-2026-109618 and CVE-2026-109619. These flaws, which received a CVSS score of 9.2, could allow attackers to execute code remotely on servers without any authentication.

The vulnerabilities stem from memory safety issues in PHP, affecting versions as far back as 5.4.0. This means that a significant number of websites, estimated at 70%, could be at risk, including popular platforms like WordPress and Drupal. The flaws allow unauthorized access to sensitive data and the potential execution of malicious commands.

OpenAI collaborated with researchers from Calif and Wiz to identify these vulnerabilities, which were independently verified on WordPress and Drupal in August 2026. The findings were part of OpenAI's Patch the Planet initiative, aimed at using AI to identify security flaws before they can be exploited.

In response to the vulnerabilities, PHP maintainers have released patches for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Alongside the disclosure, OpenAI introduced a tool called php2shell-checker, allowing site operators to assess their vulnerability without sending exploit traffic.

Website operators are strongly advised to check their PHP versions and upgrade to the patched releases to avoid potential security incidents that could undermine user trust and lead to significant financial losses.