[AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months
- ID
- 38238
- Status
- summarized
- Published
- 22 Oct 2026, 3:42 PM
- Fetched
- 22 Oct 2026, 4:46 PM
- Provider
- Latent Space
- Category
- developer-ai
- Original URL
- https://www.latent.space/p/ainews-openais-patch-the-planet-program
- Source URL
- https://www.latent.space/feed
Summary
- Score
- 8.0
- Created
- 22 Oct 2026, 4:46 PM
- Tags
- Audience
- developersvibe_coderssaas_foundersai_ml_learners
What happened
AINews reports two core PHP memory-corruption bugs, CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell, tied to PHP's out-of-memory and fatal-error handling rather than a plugin or app auth layer. Researchers demonstrated pre-auth RCE against WordPress, Drupal and Joomla plus remote memory disclosure against any PHP application, with discovery by Ryan Austin at Calif via OpenAI's Patch the Planet using GPT-5.6 Sol and separately by Wiz using Gemini 4 Argon, GPT-5.6 Sol and Wiz Atlas. The excerpt says a two-month coordinated response followed and that severity versus Log4Shell/Heartbleed is still debated.
Why it matters
If you run PHP, WordPress, Drupal, Joomla or any SaaS stack with PHP in it, the concrete action is to check exposure and patch status for CVE-2026-109618 and CVE-2026-109619 against the real advisory, because this excerpt gives no fixed version. It also means AI models are now part of core-dependency vulnerability discovery, so teams should expect more disclosures like this and plan response time rather than treat it as an AI-lab story.
Discussion angle
Ask who in the room actually knows whether their PHP runtime or CMS is exposed, and whether AI-found CVEs like PHP2Shell change how they staff patch response, especially while the severity claim is still contested.