OpenAI models helped researchers find critical PHP RCE flaws affecting ~70% of websites
moyix · x · 2026-10-21
Researchers in OpenAI's Patch the Planet initiative, with help from OpenAI models, discovered two critical PHP engine flaws (php2shell) affecting the language powering 70% of websites.
- CVE-2026-109618: out-of-memory handling can interrupt PHP while request data is only partially initialized; cleanup may treat invalid data as valid, enabling RCE.
- CVE-2026-109619: request-owned global state can outlive its freed backing memory, letting a later request on the same worker use stale state, also enabling RCE.
Credits include researchers from WIZ, areion, lcfh, and OpenAI. OpenAI led a coalition with the PHP Foundation and maintainers over two months to land an intricate fix requiring major engine changes. All PHP sites should upgrade immediately; additional mitigations are available from security vendors.
More from Models
- OpenAI and Apollo Research find o3 can detect when it's being safety-tested — alex_verem · 2026-10-22
- Pichai amplifies Ramp bench: Gemini 4 Argon tops accounting eval at 61.1%, 10.6 pts over Opus 5.5 — sundarpichai · 2026-10-22
- IBM releases Granite Speech 5.0 2B open speech model on Hugging Face — seamonn · 2026-10-21
- Claude's safeguards easily bypassed with light jailbreaking, Transformer reports — ShakeelHashim · 2026-10-21
- Poking into Qwen3-8B weights reveals simpler neuron activation in early and late layers — maxsloef · 2026-10-21
- Claude Sonnet 5.5 and GPT-6 Astra tie atop medical long-context leaderboard as cost gaps hit 80x — ArtificialAnlys · 2026-10-21