[AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months

Researchers disclosed two PHP-engine memory-corruption vulnerabilities, named PHP2Shell (CVE-2026-109618 and CVE-2026-109619), with reported pre-authentication RCE demonstrations against WordPress, Drupal and Joomla and Heartbleed-style memory disclosure. OpenAI says Calif researchers found the flaws using GPT-5.6 Sol under its Patch the Planet project, while secondary reporting says Wiz independently found the same bugs, and OpenAI describes roughly two months of coordinated remediation before disclosure. Cloudflare deployed WAF mitigations before the scheduled patch release, calling them a stopgap and directing operators to patch at 14:00 UTC.