Latent Space AINews: OpenAI and Wiz Use AI Models to Discover PHP Core Vulnerabilities, Triggering Global Coordinated Remediation
This issue of AINews focuses on how OpenAI's Patch the Planet project and security firm Wiz utilized models like GPT-5.6 Sol and Gemini 4 Argon to independently discover and help remediate the widespread PHP2Shell vulnerabilities. The report details the two-month coordinated response timeline, specific contributions from various parties in discovery and patch validation, and emergency mitigations by agencies like the U.S. NSA and Cloudflare. It also covers other industry updates including the launch of the Flint local coding model, DeepInfer inference framework, Claude Duet research preview, and Nvidia chip orders amid HBM supply crunches.
This week's Latent Space AINews roundup (covering October 20–21, 2026) places the headline focus on the recent PHP2Shell vulnerability incident. The report notes that OpenAI's "Patch the Planet" project and security firm Wiz acted as two independent parties, leveraging advanced AI models such as GPT-5.6 Sol and Gemini 4 Argon to discover two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP's internal handling of out-of-memory conditions and fatal errors. These flaws allowed unauthenticated remote code execution against major CMS platforms like WordPress, Drupal, and Joomla, with some researchers describing them as the most consequential vulnerabilities they have helped discover.
The report emphasizes that this was a typical multi-party collaboration rather than a single-vendor victory. OpenAI described an approximately two-month coordinated remediation period involving close cooperation among PHP maintainers, researchers, security providers, and even governments. Cloudflare confirmed via its CTO that initial WAF mitigations were deployed before the scheduled patch release, covering known exploit vectors and available to all customers, but explicitly stated these rules were a stopgap and that patching remained mandatory. Meanwhile, the U.S. National Security Agency (NSA) issued warnings advising operators to prepare for immediate updates and consider taking systems offline if timely mitigation was not possible.