OpenAI proposes five stages for responding to PHP flaws

OpenAI’s account dated October 21, 2026, describes a coordinated response to two critical PHP vulnerabilities and proposes a five-stage process for handling similar flaws. PHP identifies the issues as CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution, and lists four fixed releases. PHP maintainers led the fixes and their publication, according to OpenAI.

What the two PHP vulnerabilities do

Remote code execution means an attacker can cause a server to run code. PHP says both vulnerabilities can allow it without authentication, but their failure mechanisms differ.

CVE-2026-109618 involves out-of-memory handling. If a request is interrupted while internal data is only partly initialized, PHP’s cleanup process can treat invalid data as valid.

CVE-2026-109619 involves stale global state. Internal state belonging to one request can remain accessible after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

PHP lists installations serving web requests as potentially at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP identifies Apache with mod_php as the highest-risk configuration among those it names.

Which PHP releases include the fixes?

PHP’s security releases on October 21, 2026, fixed both vulnerabilities in these branches:

PHP says temporary measures can reduce exposure to particular attack paths, but do not make an installation safe. Updating to a fixed release is the complete solution. For more background on the release list, see NeoTeo’s earlier coverage of the PHP fixes.

PHP 8.1 and older no longer receive fixes directly from the PHP project. PHP published minimal source backports for PHP 7.4, 8.0 and 8.1; operators using an older branch can also check for fixes from their distribution or long-term-support vendor. The PHP security archive lists the vulnerabilities and release details.

OpenAI’s five-stage response proposal

OpenAI presented the framework as a proposal for critical vulnerabilities in widely used software, not as an adopted industry standard. Its five stages are:

1. Validate the flaw and develop a fix upstream. The maintainers, researchers and essential technical partners confirm the issue, assess its impact, and develop and test a correction, including adversarial testing.
2. Give affected organizations time to prepare. Maintainers decide which organizations to involve before disclosure, based on their protective role, ability to handle sensitive information and time needed to act.
3. Coordinate with government partners. OpenAI says it worked with partners to involve U.S. bodies including CISA, the Office of the National Cyber Director and the White House Superintelligence Force, along with international partners.
4. Prepare updates for affected products. Distributors, hosting and service providers, response teams and operators may prepare updates as the fix and disclosure plans take shape.
5. Publish guidance and support implementation. Public recommendations help operators assess exposure, find updates or interim measures, and put the fix into use.

OpenAI says response timelines may be reassessed if exploitation is active, details leak, a public patch reveals the flaw, or delay increases risk to users. That flexibility is part of the proposal’s approach to balancing preparation time against the need to protect users.

What OpenAI says about discovery and support

OpenAI says Calif identified one PHP flaw using GPT-5.6 Sol, and that Wiz independently found and reported both vulnerabilities. The company also names Wiz and Cloudflare among the partners that contributed research, technical support and coordination. OpenAI says PHP maintainers led the corrections and their publication.

OpenAI also said it committed $1 billion to subsidize Daybreak access through Daybreak for Frontline Defenders. The program is aimed at organizations protecting essential services with limited security resources.