OpenAI's Codex Security helps uncover two critical PHP flaws before attackers could

#What happened

On October 21, 2026, OpenAI announced that its models helped uncover two critical vulnerabilities in the PHP engine, working alongside researchers from Calif and Wiz. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, both with CVSS scores of 9.2. Both allow remote code execution and memory disclosure, with no authentication required, and affect PHP versions going back to 5.4.0. The findings were credited to Calif, Wiz, and OpenAI Codex Security, and the remote code execution was independently verified on WordPress and Drupal in August 2026. A fix was ready before attackers could weaponize the bugs, and the disclosure was coordinated with AWS, Google Cloud, and Microsoft.

#Why it matters

The two vulnerabilities could potentially impact an estimated 70% of websites that rely on PHP, including WordPress, Drupal, and MediaWiki installations, so operators of those sites face an urgent need to update to the patched PHP versions. OpenAI is framing the episode as a "Defender's Window": AI tools surfacing flaws before malicious actors can find and exploit them. Codex Security Cloud launched at DevDay 2026 as OpenAI's continuous vulnerability scanning for GitHub repos; this PHP disclosure is its first major public bug-hunting credit.