OpenAI’s Codex Security helps uncover two critical PHP flaws before attackers do

The software quietly running a huge share of the internet just had a very close call. On October 21, 2026, OpenAI announced that its models helped uncover two critical vulnerabilities in the PHP engine. The discovery came alongside researchers from Calif and Wiz. A fix was ready before attackers could weaponize the bugs. The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS score of 9.2, placing them firmly in critical-risk territory. What the researchers found Both vulnerabilities open the door to remote code execution, or RCE. That means an attacker could potentially run their own commands on a server from somewhere else entirely. The flaws also allow malicious memory disclosure, meaning an attacker could access sensitive data sitting in a server process’s memory. No authentication is required. An attacker would not need a login, a stolen password or an inside contact to try it. The bugs affect PHP versions going back to 5.4.0, so the flaws have been lurking in the codebase across many years of releases. How the bugs work The root cause sits in memory safety. The problems stem from how PHP handles out-of-memory situations and from stale global state ...