OpenAI Says Its GPT-5.6 Sol Model Helped Find The PHP2Shell Flaws – How Does AI-Led Bug Hunting Change Open-Source Security?

Les-Leigh A October 23, 2026

AI tools are now finding security bugs in software. But people still have to fix those bugs, and the work often falls to small teams of volunteers.

A good example appeared this week with PHP2Shell. This is the name for two serious security problems in PHP, a programming language used by a huge number of websites. Both problems have now been fixed in supported PHP versions. OpenAI says its GPT-5.6 Sol AI model found the problems. The company also expects the number of similar discoveries to rise sharply in the near future.

PHP2Shell refers to two security weaknesses called CVE-2026-109618 and CVE-2026-109619. They affect the way PHP manages computer memory and handles errors during normal website requests. According to the PHP Foundation, someone who has not logged in could, under certain conditions, damage or reuse memory in a way that lets them run their own instructions on a server. The Foundation says researchers showed this could happen on an Apache server using its default settings.

It might sound as though OpenAI discovered everything on its own, but several other groups were involved. Calif.io, Wiz, OpenAI and Quarkslab all helped report the problems. The PHP Foundation also thanked OSTIF, its own security team and volunteers.

OpenAI presented the discovery as evidence that powerful AI can find security weaknesses before hackers do. But the people who develop PHP say the full story is more complicated.

Months Of Work Before The Fixes Were Ready

The problems were actually found long before the public heard about them.

According to the PHP Foundation, Calif sent its first report on 11 August. Wiz reported some of the same problems on 24 August. Then, on 18 September, OpenAI separately reported exactly the same underlying cause. The fixes were not released until 21 October. They were included in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The fixes came out one day earlier than planned. The PHP Foundation says that around 15:00 UTC on 20 October, the CVE identification numbers began appearing on online forums and social media. The leaked information included the wrong release time and an incorrect CVSS security severity score of 10.0. The real score was 9.2. Because of the leak, the team had to change its schedule quickly.

There were other mistakes too. According to the Foundation, Calif accidentally published a video showing how the security problem could be used, then deleted it. Chainguard also published updated container images containing the fixes more than six hours before the agreed release time.

Amazon Web Services' threat intelligence team also says its honeypot systems, which watch for possible attacks, recorded an attempt to exploit the weakness on 17 October. That was four days before the public announcement. This is AWS's claim, based on its own data.

Who Pays When More Bug Reports Arrive?

The PHP Foundation says AI-assisted research is already causing more security reports to arrive. Since 1 July, its security team has published 15 CVEs, which are official records of security weaknesses. It has also checked more than 100 reports that were incorrect, repeated problems already reported, or described problems the team could not recreate. The Foundation says AI helps check reports and identify reports caused by the same underlying bug. But people still make every decision and work on every fix.

The Foundation says fixing PHP2Shell became its security team's most important job on 11 August. Without money from the Foundation, it could not have paid people to work full time and through weekends. The repair was also difficult. The problems were in the code that manages memory and errors, which runs during almost every website request. The team had to make sure the changes would still work with older software, would not create new ways to knock services offline, and would not break extensions made by other developers.

Reports say the fixes only cover PHP 8.2 and newer versions. PwC says this means PHP 8.1 and older versions have no official fix from the main PHP project. People using those older versions must depend on Linux distributions or companies providing long-term support to adapt the fixes for them.

If the Foundation's report numbers show a wider pattern, the amount of work for security teams is already increasing. So we asked experts how AI-powered bug discovery changes the workload, costs and process of reporting security problems for people who maintain free, open-source software.

Our Experts

• Mudita Khurana, Staff Security Engineer at Airbnb
• Mugees Ahmed, Founder of DistroCode
• Rodion Sorokin, Co-Founder and CTO of The Capital Index
• Roman Martynenko, Founding Full-Stack Engineer at Henry AI
• Rajeshkumar Rajaseakaran Nair, Test Specialist at IBM Corporation
• T.J. Marlin, Founder and CEO of Guardrail Technologies
• Kadan Stadelmann, Founder and Former CTO of Komodo Platform
• Mandy Andress, CISO at Elastic

Mudita Khurana, Staff Security Engineer, Airbnb

“AI can make it cheaper to find complicated security weaknesses, but much of the cost then moves to the people who maintain open-source software. The PHP Foundation says it has checked more than 100 reports since July that were wrong, repeated earlier reports, or described problems that could not be recreated. Someone still has to test each report, understand how serious the problem is, create a fix that does not break existing software, and arrange updates with Linux distributions and hosting companies.

“AI also makes it harder for everyone to agree on when to reveal a security problem. Maintainers may get several AI-generated reports that describe different signs of the same bug. At the same time, attackers can develop ways to use these bugs more quickly. AI security programmes should include a test that clearly shows the problem, a human researcher who can answer questions, and enough time for other software providers to prepare their updates.”

Mugees Ahmed, Founder, DistroCode

“We make WordPress plugins and look after websites for clients, so we see both sides of this problem. AI makes bugs cheaper to find, but not cheaper to fix. Maintainers will receive more reports without getting more time to deal with them. Someone still has to recreate each reported problem, check whether it is a false alarm, then fix and test it.

“It also becomes harder to keep security problems secret until fixes are ready, because more groups discover the same bug. Fortune reports that Calif and Wiz both used AI and separately found parts of PHP2Shell in August. This time, the CVE identification numbers leaked, and PHP released its fixes a day early.”

Rodion Sorokin, Co-Founder and CTO, The Capital Index

“AI has made finding bugs cheap. But fixing them still costs a lot, and volunteers often end up doing the work. PHP supports a huge part of the web, yet the PHP Foundation spent $784,376 last year and paid for 11 developers. OpenAI expects the number of similar discoveries to rise sharply. But the number of people available to maintain the software is not growing in the same way.

“The process of safely announcing bugs is also under pressure. It depends on keeping information secret until everyone is ready. In this case, the CVE identification numbers leaked, and PHP released its fixes one day early. A fair rule would be that anyone using AI to find a bug should also provide a tested fix and money to support the work, not just a report. Otherwise, maintainers will be overwhelmed by reports.”

Roman Martynenko, Founding Full-Stack Engineer, Henry AI

“AI is changing the cost of looking after software even before it changes the technology itself. Finding security weaknesses is becoming faster and cheaper. But people still have to prove that a problem is real, write a fix that does not break software for existing users, test the fix on different versions, and share the information in the right order. Most open-source projects have very little spare time or help for this work.

“That difference creates a risk. If AI systems start finding serious problems much faster, maintainers will spend less time looking for bugs and more time sorting reports, checking whether they are real, and organising software releases under pressure. Projects with plenty of money can manage this. Small projects run by volunteers cannot easily do so, even when thousands of working systems depend on their code.

“The answer is not to slow down the search for bugs. Instead, we need to pay for and provide people to do the less exciting work: checking reports, testing fixes and setting clear dates for sharing security information. Bug discovery is growing quickly. The work of maintaining software must grow too. Otherwise, the growing list of unfixed problems becomes a security weakness itself.”

Rajeshkumar Rajaseakaran Nair, Test Specialist, IBM Corporation

“AI is changing how much it costs to keep open-source software secure. The biggest problem is no longer just finding security weaknesses. It is checking whether they are real.

“AI can find possible weaknesses in much greater numbers than people checking code by hand can easily manage. But before a fix is released, someone still has to show that the problem can be recreated, work out how much damage it could cause, repair it, and test that the repair does not break anything else. For volunteers who maintain software, this can mean more unpaid work, especially when AI reports contain false alarms or repeat problems already reported.

“Sharing security information safely also becomes harder. Reports that the PHP2Shell fixes were released early after the CVE numbers appeared online show how quickly maintainers can come under pressure when information spreads before everyone has finished preparing.

“AI-generated security reports should include clear evidence that lets others recreate the problem. Where possible, they should also include tests that help make sure the problem stays fixed. This would let maintainers check the findings instead of having to investigate everything from the beginning. Organisations that build AI bug-finding tools should also help pay for checking and sorting reports, not just finding bugs.

“Finding problems faster only makes software safer if maintainers can fix them quickly enough.”

T.J. Marlin, Founder and CEO, Guardrail Technologies

“People who maintain open-source software are facing more work than most projects were designed to handle. AI is finding security weaknesses in code that has existed for decades. But the people responsible for fixing these problems are often small teams of volunteers. Every new report takes time to check, and some AI-generated reports will turn out to be useless or incorrect.

“The bigger worry is that maintainers have less time to respond. Finding a problem is only the first step. They still need to check that it is real, prepare fixes, adapt those fixes for older versions, and warn users. AI is making discovery faster, but the rest of the process has not become faster in the same way. If information leaks before fixes are ready, people using the software remain at risk. PHP2Shell shows how quickly sharing security information can become a problem when details come out before maintainers are prepared.”

Kadan Stadelmann, Founder and Former CTO, Komodo Platform

“Because of AI-powered searches for security weaknesses, software maintainers are having to go through more bug reports than ever before. People check many of these reports and find that they are false alarms. Some reports are also missed and are not dealt with quickly enough, or are never dealt with at all.

“The costs can be huge, as PHP2Shell shows. People and resources from around the world, including governments and large companies, were brought together to organise the fix and its announcement. Work on patches is still continuing. More bug reports keep arriving, and people have to check whether the reported problems are real.

“People still control when and how security problems are announced, which means there can be gaps in the process. Right now, there is a race between people protecting systems and attackers looking for weaknesses. This is only the beginning.
“With PHP2Shell, information about the problem appeared before the PHP Foundation acted, and the Foundation needed prompting because of the way its decision-making system works.

“It started with AI building on the work of human cybersecurity researchers and exploring areas that would have been too difficult or impractical for those researchers to investigate themselves.”

Mandy Andress, CISO, Elastic

“Over the past few days, several serious security weaknesses have been made public, and AI found many of them. If it seems like things are moving faster, that is because they are. This is not surprising. We expected it to happen, but we were not completely ready.

“If you lead a security team, you can see the effects on your people. The list of fixes that need to be installed keeps growing. Urgent security warnings keep arriving, and the same people are expected to treat every problem as an emergency. This can leave teams exhausted and tired of dealing with security weaknesses. Exhausted teams can miss important problems. Manage the workload for yourself and your team, and make it clear that you cannot deal with every CVE at the same speed.

“This is also a good time to think beyond the list of software fixes. If your safety depends on installing fixes faster than attackers can use security weaknesses, the way your systems are built is making your job harder. Ask which basic security improvements would make weaknesses less dangerous. These include separating systems into safer sections, reducing the number of ways attackers can get in, giving people and programs only the access they need, checking identities more carefully, and improving how you spot and respond to attacks that get through.

“Installing security fixes will always be important. But building systems that can handle problems is how we get through this period without exhausting the people protecting us.”