PHP discloses two ultra-high-severity vulnerabilities; OpenAI says GPT-5.6 Sol discovered them first

PHP has disclosed two ultra-high-severity vulnerabilities with a severity score of 9.2 (CVE-2026-109618, CVE-2026-109619), collectively called PHP2Shell; in the most severe case, an attacker can execute code remotely without logging in, affecting almost all versions from PHP 5.4 onward. OpenAI's announcement states that the security company Calif discovered these vulnerabilities using GPT-5.6 Sol under its Patch the Planet open-source security initiative, and Wiz Research also independently discovered and reported them. Official fixed versions PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 have been released; PHP 8.1 and earlier versions are no longer supported and have no patches available, and the official statement says the only safe approach is to upgrade immediately; researchers have reproduced unauthenticated remote code execution on some WordPress, Drupal and Joomla deployments, and according to Reuters, some government websites in the Netherlands, Finland and elsewhere have been taken offline in advance.