OpenAI discloses two high-severity PHP vulnerabilities found with GPT-5.6 Sol's participation; attacks appeared before the patch was released

OpenAI disclosed that researchers, with the help of GPT-5.6 Sol, found two CVSS 9.2 vulnerabilities in the PHP engine and achieved unauthenticated remote code execution in affected deployments. The vulnerabilities, collectively called PHP2Shell, were found by Calif researchers participating in OpenAI's Patch the Planet program and involve, respectively, handling order during memory exhaustion and use-after-free; Wiz also independently discovered and reproduced the attack, and according to W3Techs, 69.3% of websites whose server-side language can be identified use PHP. PHP maintainers led the fix with OpenAI coordinating; coordinated disclosure was originally set for October 22, but the vulnerability IDs, an attack demonstration video and a fixed image leaked in succession in the final 48 hours, and the patch was released early on the 21st, covering PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.