OpenAI and Google AI Models Uncover Critical PHP Vulnerabilities Affecting Majority of the Web

OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon have helped researchers discover two critical remote code execution vulnerabilities in PHP, the server-side language powering an estimated 70% of websites worldwide. The flaws, designated CVE-2026-109618 and CVE-2026-109619 and collectively named PHP2Shell, were identified through OpenAI's Patch the Planet initiative, a coordinated effort to secure critical open-source software using frontier AI models paired with expert human review.