OpenAI's GPT-5.6 Sol found two PHP RCE flaws scored 9.2 as PHP2Shell

Under OpenAI's Patch the Planet program, GPT-5.6 Sol discovered two unauthenticated remote-code-execution flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 with a CVSS score of 9.2, affecting branches 5.4 through 8.5. Details leaked a day before coordinated disclosure; the PHP Foundation shipped fixes on October 21 only for PHP 8.2 and newer, while Cloudflare counted millions of exploitation attempts.

• CVSS 9.2 unauthenticated RCE in PHP 5.4–8.5, roughly 70% of websites affected
• Patches released October 21 cover only PHP 8.2+, legacy branches left unfixed
• Amazon said attackers exploited the flaws four days before public disclosure
• Over 30 UK government services went offline; Wikimedia and Orange restricted access