OpenAI says GPT-5.6 Sol helped find a critical PHP flaw

OpenAI said on Oct. 21 that a Calif researcher used GPT-5.6 Sol to identify a critical PHP flaw, while Wiz independently reported both vulnerabilities and says its Aug. 19 discovery also used Gemini 4 Argon. PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 the same day for CVE-2026-109618 and CVE-2026-109619, which it says allow unauthenticated remote code execution, and said updating is the only complete fix. OpenAI says the bugs are among several it has found and that it has committed $1 billion in subsidized Daybreak access for frontline defenders.