Two critical vulnerabilities in PHP became public on October 21. The security firm Calif discovered one of the flaws using OpenAI GPT-5.6 Sol in August. Wiz found both and reported them independently. PHP powers nearly 70 percent of all websites. The flaws allow unauthenticated code execution. Calif reported the first bug to PHP on August 11. The firm confirmed a working exploit by August 15. OpenAI coordinated the response for two months. Amazon Web Services said hackers exploited the flaw on October 17. The patch arrived October 21.
A working exploit existed 67 days before the patch. OpenAI and the PHP Foundation coordinated fixes and firewall rules during that window. The bugs sat in the codebase for a decade. AI models turned them into working exploits in about a week.
The discovery window closed before the patch window opened
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Each carries a CVSS score of 9.2. Fixed builds are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Amazon and other organizations received private notice in advance. They agreed not to publish before 14:00 UTC on October 21. Information about the vulnerabilities leaked in the days leading up to the announcement. Exploits started four days early.
The construction ERP logged no attacks. The permit app logged no attacks. The attackers hit Amazon first. They had four days to scan the internet before the patch arrived. My systems did not appear in their scan.
The model found bugs a 2024 audit missed
Google said Gemini 4 Argon made an invaluable contribution to finding the vulnerability. The model also helped validate the patch. A 2024 audit found the first signs of the flaw but established no working exploit. The 2026 reports from Calif, OpenAI and Wiz used AI tools. They established the exploit that made the full impact clear. The Wall Street Journal ran the story as its lead. The headline said AI found a bug in 70 percent of websites.
OpenAI updated its Daybreak website two weeks ago. The number of flaws discovered by participants rose from 858 to 1,885. Patches increased from 263 to 661. OpenAI pledged one billion dollars in subsidized Daybreak access for frontline defenders. OpenAI said it expects similar findings to increase sharply in the coming months.
The model found it before I did.
None of my systems run PHP. The dating-profile tool runs on a Cloudflare Worker with no PHP anywhere in the stack. Those systems were never vulnerable. PHP sites stayed exposed for those 67 days. A coalition built the patch during that window. Attackers built the exploit. The coordination window was longer than the warning window.