OpenAI describes coordinating PHP's disclosure of…

OpenAI describes coordinating fixes for two critical PHP flaws after Calif identified one using AI and Wiz independently found both; PHP released fixes on October 21, and OpenAI proposed a disclosure framework. Follow-up evidence includes CISA’s October 26 listing of both flaws as known exploited and Palo Alto Networks’ report of active exploitation against internet-exposed management interfaces. Wiz’s October 27 report describes declining observed exposure and failed chains in its own captured attempts; this does not establish an absence of exploitation elsewhere or a global compromise count.

Why it matters

It sets a lab's proposed process for disclosing AI-found flaws in internet-scale software beside the maintainer's advisories, a second finder's account, and reports that the embargo leaked before patches shipped.

Key facts

As stated in the sources, with where to find them.

PHP's two advisories, published 2026-10-21, rate both flaws Critical (CVSS v4 9.2) and list PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as patched. PHP states confirmed impact as unauthenticated remote code execution with the web worker's privileges: for CVE-2026-109618 (out-of-memory handling) validated against Apache mod_php, and for CVE-2026-109619 (stale request state reused by a subsequent request) validated against mod_php and, on one path, PHP-FPM.GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, Affected versions; Impact and reliability; Severity
PHP's news post says only an update is a complete fix, that Linux distributions and LTS vendors received patches in advance, that PHP 8.1 and older receive no project updates, and that the PHP security team provided minimal source backports for PHP 7.4, 8.0 and 8.1 given the severity.PHP news archive 2026, How to update
OpenAI's proposed framework has five stages: validate and fix upstream (including adversarial testing of the patch with frontier models), give affected organizations time to act, coordinate with government partners, prepare updates across affected products, and publish guidance and support deployment. For PHP, OpenAI says it engaged the White House's Super Intelligence Force, the Office of the National Cyber Director, CISA and international partners.OpenAI post, Coordinating a global response
OpenAI says that to its knowledge frontier AI found these flaws before attackers did, assesses their impact as substantial, and expects similar findings to increase sharply. These are OpenAI's assessments; Amazon's report below bears on how long the defenders' window lasted.OpenAI post, introduction
OpenAI cites its $1 billion commitment in subsidized Daybreak access through Daybreak for Frontline Defenders, a PHP version checker shared as a Codex skill, Codex for OSS subscriptions for maintainers, and work calibrating additional blocking classifiers for Daybreak, which it says involves tradeoffs with legitimate security work.OpenAI post, introduction; Giving maintainers the capacity and resources to respond
Wiz's timeline: discovery of the first flaw on 2026-08-19 using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol; unauthenticated RCE confirmed against Drupal on 2026-08-20 and WordPress on 2026-08-21; report to PHP on 2026-08-24; PHP acknowledgement and start of a coordinated fix on 2026-09-21 (PHP's own account, via The Record, puts the start of fix work at August 11); patches and disclosure on 2026-10-21. Wiz reports demonstrating pre-authentication RCE on WordPress, Drupal and Joomla container images and remote memory disclosure.Wiz blog, Responsible disclosure timeline; Impact
Wiz says frontier models made it practical to adapt exploits across PHP versions and memory layouts, and that a single researcher completed in a week what previously would have taken a team months; these are Wiz's own estimates. Wiz says every PHP version back to 5.4 is affected by at least one of the issues.Wiz blog, The AI inflection point; Conclusion; Executive Summary
Wiz's table assigns the upload-progress unserializer use-after-free to CVE-2026-109618, whereas PHP's advisories describe CVE-2026-109618 as the out-of-memory corruption flaw and place the session upload-progress path under CVE-2026-109619. This record follows PHP's descriptions.Wiz blog, The Vulnerabilities; GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, Summary
The Record reports a PHP Foundation statement saying CVE-2026-109618 traces to a 2024 external audit after which a fix stalled, that a Calif researcher reported the bugs on August 11, and that OpenAI, Wiz and Trail of Bits also found them. It reports the foundation saying disclosure was moved up a day after rumors spread, that Calif mistakenly published a proof-of-concept video, and that Chainguard released patched images before the embargo ended; Chainguard's CEO told the outlet he had seen exploitation attempts.The Record, AI spotlights bugs
BleepingComputer reports Amazon Threat Intelligence saying exploitation attempts began on 2026-10-17, four days before patches, against a honeypot from anonymized infrastructure; Amazon says it is unclear how the actor obtained exploit information or whether any of the attempts it saw would have succeeded, and its CISO says the flaws were being broadly exploited after disclosure.BleepingComputer, Broadly exploited in the wild
CISA’s catalog lists both PHP flaws with dateAdded 2026-10-26. Palo Alto Networks’ advisory, updated October 29, states that active exploitation was observed against internet-exposed management interfaces; it does not provide a victim count.CISA KEV JSON, the two CVE entries; Palo Alto Networks, Exploitation Status and update date
Wiz reports an approximate 67% decline in daily distinct exposed vulnerable machines and a 47.9% decline in organizations with at least one such instance. These are different denominators within its telemetry; changing coverage, retirement and access restriction can affect them, so they are not direct global patch-adoption rates.Wiz, Observed exposure trends
Wiz says the two exploit-kit variants it captured did not complete their chains, while partners privately shared working exploits. Wiz also reports successful exploitation of another researcher’s honeypot; failed attempts in its own telemetry do not establish an absence of exploitation elsewhere.Wiz, Introduction; Exploitation attempts observed by Wiz research; Other attempts

Record updates

Oct 30, 2026 · New evidence
Added CISA’s exploited-vulnerability listings, Wiz’s scoped remediation and exploitation telemetry, and Palo Alto Networks’ active-exploitation statement. Attempt counts, successful exploitation and exposure reductions remain distinct.

Findings that cite this record

Nov 1, 2024

AI systems find real, previously unknown vulnerabilities in widely used open-source software.

Corroboratedobserved11 evidence records

Key questions this bears on

Is AI shifting the balance between finding and fixing vulnerabilities?Discovery is ahead. Verification, triage, coordinated disclosure and safe repair remain bottlenecks between AI findings and deployed fixes.
How are attackers using AI agents in real operations?To run parts of intrusions at scale: vendors report a state-aligned actor and criminal groups using open-source agent frameworks and commercial models.