PHP flaws found with GPT-5.6 Sol force emergency patching worldwide

Any organisation running PHP on a public web server spent this week choosing between downtime and exposure. Two critical flaws, one of them found with OpenAI's GPT-5.6 Sol, forced emergency patches and pushed public bodies to pull services offline.

PHP issued fixes for supported versions after the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, came to light. According to its security advisory, every installation serving web requests could be exposed. Either bug could let an attacker run code on a vulnerable server without login credentials.

The costs showed up fast. Finland temporarily shut down government web services. Edinburgh council and the BBC took pages offline. Security agencies advised organisations that could not patch quickly to isolate vulnerable systems.

Operators on older, unsupported releases are in the weakest position. They face a harder upgrade path than those on supported versions, which received patches directly.

OpenAI said in its coordinated disclosure post that a critical flaw was identified using GPT-5.6 Sol. Wiz independently found both vulnerabilities. OpenAI described the gap between AI-assisted discovery and public disclosure as a "Defender's Window", in which maintainers can patch before attackers gain the same capabilities. These details come via The Neuron's summary; the OpenAI and PHP pages were not read directly.

The commercial lesson is about speed. A bug in a language that underpins a large share of web infrastructure cost governments and a major broadcaster service availability within days. Teams without a fast patch process, or with a stack stuck on unsupported PHP, carry the most risk and the largest bill.

OpenAI gains a credible security showcase for GPT-5.6 Sol, and its "Defender's Window" framing positions AI labs as partners to maintainers rather than a threat. But the framing assumes the window holds. Wiz found both flaws independently, so more than one party could find such bugs. Watch how quickly organisations on unsupported versions migrate, and whether coordinated disclosure keeps pace as AI-assisted discovery spreads.