AI found the PHP flaws before attackers did, the industry got a head start, and a leak of the CVE numbers ended it a day early
2026-10-22Security
Two unauthenticated remote code execution flaws in PHP itself. OpenAI says one was found by Calif using GPT-5.6 Sol and both by Wiz independently, with a coordinated response behind it. Then the identifiers leaked.