The 2 vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were rated 9.2 out of 10. They allow remote code execution without authentication. One involves faulty handling of out-of-memory conditions. The other reuses freed memory.

One flaw was found by researcher Calif with GPT-5.6 Sol. Wiz independently discovered and reported both. PHP developers released emergency updates.

OpenAI’s Patch the Planet initiative checks flaws with AI, prepares fixes, hardens providers’ systems, then publishes the details. The company also allocated $1 billion in subsidized Daybreak access for under-resourced organizations protecting critical services.