# PHP flaws found with GPT-5.6 Sol force emergency patching worldwide

> Two critical PHP flaws, one found using OpenAI's GPT-5.6 Sol, forced emergency patches and outages.

*Two critical remote-code-execution bugs hit every PHP installation serving web requests, and a government and a broadcaster pulled services offline.*

By Bez · InsidersFeed
Canonical: https://insidersfeed.com/news/php-flaws-found-with-gpt-5-6-sol-force-emergency-patching-worldwide

Any organisation running PHP on a public web server spent this week choosing between downtime and exposure. Two critical flaws, one of them found with OpenAI's GPT-5.6 Sol, forced emergency patches and pushed public bodies to pull services offline.

PHP issued fixes for supported versions after the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, came to light. According to its [security advisory](https://www.php.net/archive/2026.php#2026-10-21-5), every installation serving web requests could be exposed. Either bug could let an attacker run code on a vulnerable server without login credentials.

The costs showed up fast. Finland temporarily shut down government web services. Edinburgh council and the BBC took pages offline. Security agencies advised organisations that could not patch quickly to isolate vulnerable systems.

Operators on older, unsupported releases are in the weakest position. They face a harder upgrade path than those on supported versions, which received patches directly.

OpenAI said in its [coordinated disclosure post](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/) that a critical flaw was identified using GPT-5.6 Sol. Wiz independently found both vulnerabilities. OpenAI described the gap between AI-assisted discovery and public disclosure as a "Defender's Window", in which maintainers can patch before attackers gain the same capabilities. These details come via The Neuron's summary; the OpenAI and PHP pages were not read directly.

## The Insider view

The commercial lesson is about speed. A bug in a language that underpins a large share of web infrastructure cost governments and a major broadcaster service availability within days. Teams without a fast patch process, or with a stack stuck on unsupported PHP, carry the most risk and the largest bill.

OpenAI gains a credible security showcase for GPT-5.6 Sol, and its "Defender's Window" framing positions AI labs as partners to maintainers rather than a threat. But the framing assumes the window holds. Wiz found both flaws independently, so more than one party could find such bugs. Watch how quickly organisations on unsupported versions migrate, and whether coordinated disclosure keeps pace as AI-assisted discovery spreads.

## Key takeaways

- AI-assisted bug discovery now drives emergency patch cycles for software that much of the web runs on.
- Finland, Edinburgh council and the BBC took services or pages offline while exposed.
- Unsupported PHP versions face a harder upgrade path than patched, supported releases.

## Sources

- [Coordinated disclosure of critical vulnerabilities](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/) — OpenAI, 2026-10-22
- [PHP security advisory](https://www.php.net/archive/2026.php#2026-10-21-5) — PHP.net, 2026-10-21