How OpenAI’s proposed PHP disclosure framework works

OpenAI published a five-stage proposal for coordinating vulnerability disclosure on October 21, 2026, during the response to two critical PHP flaws. The plan covers how maintainers, affected organizations, security providers, and government partners could prepare a fix and guide its deployment. It remains a proposal, and OpenAI asked the security community for feedback.

PHP is an open-source programming language that runs on web servers. In OpenAI’s account, Calif found one flaw using GPT-5.6 Sol, and Wiz independently found both; PHP maintainers led the fixes.

OpenAI’s five proposed stages

1. Validate and fix the flaw upstream. Maintainers, researchers, and technical partners confirm the impact, develop and test a fix, and use adversarial testing to look for ways around it or related flaws.
2. Give affected organizations time to prepare. Maintainers decide whom to involve. Distributors can adapt fixes for older releases, hosts can test mitigations, and security providers can prepare detection or prevention measures such as web application firewall rules.
3. Coordinate with government partners. Agencies can help organize a broader response and route guidance to critical infrastructure and essential services. OpenAI says it involved U.S. government partners, including CISA, the Office of the National Cyber Director, and the White House Super Intelligence Force, as well as international partners in the PHP response.
4. Prepare downstream updates. Once fixes, guidance, and disclosure plans stabilize, distributors, service providers, response teams, and operators can prepare updates and identify gaps in coverage.
5. Publish guidance after a patch exists. Public instructions can help operators identify exposure, find updates or interim measures, check that a fix is running, and request help.

The sequence moves from technical validation to public deployment guidance. The middle stages give organizations and providers time to prepare, while government partners can help get advice to essential services.

When OpenAI’s proposal says the schedule should be revisited

OpenAI says participants should receive only the information needed for their protective work, with the risk of sharing even limited details weighed against the protection that sharing enables. The proposal calls for teams to reassess timing with maintainers if exploitation is active, information leaks, a public patch reveals the flaw, or stalled remediation increases risk to users.

OpenAI also asks for feedback on disclosure windows, staged early notice, backports, and safeguards for emergency patching or internet-wide scanning. Its proposal frames those as policy questions, including who is authorized to patch which systems, rather than settled rules.

The PHP flaws and their fixed releases

PHP describes both vulnerabilities as capable of enabling unauthenticated remote code execution, which means an attacker may be able to make a server run code through a remote request. PHP assigned each a CVSS v4.0 score of 9.2.

CVE-2026-109618 involves out-of-memory corruption: an interruption can leave internal request data only partly initialized, after which cleanup may treat invalid data as valid. CVE-2026-109619 involves stale global state: data belonging to one request can persist after its memory is freed, then be used by a later request handled by the same worker.

PHP listed these fixed upstream releases:

For the release announcement itself, see NeoTeo’s earlier report on PHP’s fixes. PHP says web-serving installations can be at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed; it assesses the risk as highest for mod_php.

PHP 8.1 and older no longer receive updates from the PHP project. PHP provided minimal source backports for PHP 7.4, 8.0, and 8.1, and some Linux distributions and long-term-support vendors also provide backported fixes. Operators using vendor-managed packages should check the vendor’s package status, since a distribution can backport a fix without using the same upstream release number.

What PHP’s interim measures cover

PHP says interim measures can reduce exposure to specific attack paths, but they do not make an installation safe. Updating to a fixed release is the complete solution.

For CVE-2026-109618, PHP recommends setting memory_limit=-1 in a way applications cannot override and limiting request sizes. Its advisory specifies post_max_size = 8M when uploads are not needed, or post_max_size = 32M when they are. Container or cgroup limits can provide an availability boundary.

For CVE-2026-109619, PHP recommends disabling session.upload_progress.enabled before request parsing and restarting every worker. On PHP 8.5, fatal_error_backtraces=0 blocks the confirmed fatal-backtrace path only. The PHP security advisory lists these measures and their limits.

PHP’s security archive separately recommends keeping session.upload_progress.enabled=0 until the next regular bug-fix release for another unlikely remote-code-execution vector, CVE-2026-115560. PHP says it will publish a full advisory with that release.