OpenAI outlines Patch the Planet role in response to two critical PHP flaws

OpenAI said its Patch the Planet initiative helped coordinate the response to two critical PHP vulnerabilities over roughly two months, while PHP maintainers led the fixes and release. PHP has shipped versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 with fixes for both flaws and urged users to update immediately.

PHP classified CVE-2026-109618 and CVE-2026-109619 as critical, assigning each a CVSS v4.0 score of 9.2. The project’s advisories describe conditions under which unauthenticated requests can produce remote code execution. PHP says all installations serving web requests are at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php at the highest risk because a demonstrated exploit can run before application code starts.

CVE-2026-109618 involves out-of-memory handling that can leave partially initialized request data in an invalid state. PHP’s advisory says complete unauthenticated remote code execution was validated over HTTP against mod_php using default PHP input and memory limits.

CVE-2026-109619 involves stale request-owned global state remaining after its backing memory is freed. PHP says researchers confirmed unauthenticated use-after-free, memory-disclosure and remote-code-execution paths involving mod_php and PHP-FPM. Configuration changes may reduce exposure to particular paths, the project said, but installing a patched release is the only complete mitigation.

The PHP Foundation’s account of the research sequence says it enrolled PHP in Patch the Planet before security researcher Calif began an audit on July 30. Calif reported an unconditional remote-code-execution path sharing a known out-of-memory root cause on August 11. The foundation says OpenAI independently reported the same root cause that day and added attack vectors on September 18, while Wiz reported more vectors on August 24. It thanked OpenAI Codex Security and Amy Burnett for research and responsible disclosure; both PHP advisories also list amyb-oai among the reporters.

OpenAI says it led a coalition of maintainers, researchers and security providers, supplied expertise and model access, helped test fixes and guidance, coordinated with infrastructure providers, and engaged government cyber agencies. Its account places the PHP response alongside security workflows that keep people in control of remediation and deployment.

The broader operational details are OpenAI’s account. The reviewed PHP records corroborate OpenAI’s research and reporting role but do not independently itemize each claimed coordination activity. OpenAI also said that, to its knowledge, frontier AI found the vulnerabilities before attackers did. The PHP records reviewed do not independently establish that assertion or rule out prior attacker discovery.

The disclosure schedule was disrupted before the planned October 22 release. The PHP Foundation says the CVE identifiers circulated publicly on October 20 with an incorrect release time and an incorrect 10.0 score, leading PHP to advance its pre-announcement and move the release to October 21. It also said a mistakenly published proof-of-concept video and an early release of patched container images weakened the embargo.

At release time, the foundation said the PHP security team had monitored the leaked proof-of-concept material and had not identified a functional exploit, a statement that does not establish whether exploitation occurred later. The foundation also said early signs of the out-of-memory problem had emerged in 2024, but work stalled because no concrete remote-code-execution path was then available, patch options involved trade-offs and the project had limited security staffing.