The Circuitry
THE CIRCUITRYYour one-stop source for all tech news
HOMETODAYNEWSFEEDEVENTS
BOOKMARKS
RSS
© 2026 The Circuitry
About UsSourcesContactCorrectionsPrivacy
  • Today
  • Feed
  • Events
  • Saved
  • AAPL
  • MSFT
  • GOOGL
  • META
  • NVDA
  • TSLA
  • AMZN
  • INTC
  • SONY
  • TTWO
  • COIN
  • BTC
  • ETH
  • SOL
  • AAPL
  • MSFT
  • GOOGL
  • META
  • NVDA
  • TSLA
  • AMZN
  • INTC
  • SONY
  • TTWO
  • COIN
  • BTC
  • ETH
  • SOL

Feed

Ad
From The CircuitryVerified tech news, cross-checked.How we verify →
  • DoorDash agrees to acquire Instacart for about $17 billionTech
  • Intel shares plunge after hours as Israel fab blast and PC slowdown weigh on outlookTech
  • Amazon earnings call: AWS backlog reaches $578 billion, 2027 spending to rise "meaningfully"Tech
  • Rivian R2 becomes company’s top-selling vehicle in Q3Tech
  • Reddit to require login for all users, starting with tests outside USTech
  • CISA Adds Exploited Cisco ASA and FTD VPN Crash Flaw CVE-2026-76418 to KEVSecurity
  • CISA Adds Critical GitLab CI/CD Regex Flaw CVE-2026-97229 to Exploited Vulnerabilities ListSecurity
  • Intel Q3 2026 earnings: $16.5 billion revenue, data center up 78%Tech
Scroll for more
Verification
VERIFIEDConfidence: HIGH
Source identified
Claims cross-referenced
No discrepancies found
Sourcing
1source

via openai.com

openai.com · track record
6Stories
100%Verified
430d
All sources →
Ad
From The CircuitryWhy The Circuitry

Verified tech news, cross-checked.

Every story is checked against independent sources before it posts — no rumors dressed up as fact.

How we verify →
From The CircuitryWhy The Circuitry

Verified tech news, cross-checked.

Every story is checked against independent sources before it posts — no rumors dressed up as fact.

How we verify →
Home/Tech/PHP fixes two critical remote code execution flaws found with help from AI
VERIFIEDBy Xavier Rivera·Wednesday, October 21, 2026 at 10:44 AM AST·1 min read

PHP fixes two critical remote code execution flaws found with help from AI

PHP released 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on Oct 21 to fix two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 (CVSS 4.0), and the fixes were coordinated through OpenAI's Patch the Planet effort.

Source:openai.com
Post
PHP fixes two critical remote code execution flaws found with help from AI
Ad
From The CircuitryVerified tech news, cross-checked.How we verify →
Ad
From The CircuitryWhy The Circuitry

Verified tech news, cross-checked.

Every story is checked against independent sources before it posts — no rumors dressed up as fact.

How we verify →
PHP fixed two critical remote code execution vulnerabilities on Oct 21 and is urging users to upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12. All earlier versions are affected.
Morning Brief

Get the daily tech brief

Every morning, in your inbox. What's in The Brief →

The flaws. According to PHP and NVD, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) allows remote code execution through out-of-memory corruption, where out-of-memory handling leaves request memory corrupted. CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) allows remote code execution through stale global state, a use-after-free of state left over between requests. Both are rated 9.2 (CVSS 4.0), Critical.

Who found them. Calif found a critical flaw using OpenAI's GPT-5.6 Sol, and Wiz independently found and reported both vulnerabilities. PHP's maintainers led the fixes, with OpenAI, Wiz, Cloudflare and others contributing as part of OpenAI's Patch the Planet effort, coordinated over the past two months. OpenAI also credits the White House Super Intelligence Force, ONCD, CISA and international partners.
From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →
Why it matters. The bugs are in PHP itself, which OpenAI estimates runs about 70% of websites, so they matter whatever application runs on top.

Tools. OpenAI announced a PHP version checker to help operators spot vulnerable versions, and says an accompanying Codex skill is launching. It also announced $1 billion in subsidized Daybreak access.
Ad
From The CircuitryWhy The Circuitry

Verified tech news, cross-checked.

Every story is checked against independent sources before it posts — no rumors dressed up as fact.

How we verify →
Sources: PHP ChangeLog, NVD, OpenAI
Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Morning Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning.

Two minutes, free forever. What's in The Brief →

Reader-supported
DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →
HELP US IMPROVE
From The Circuitry

See what’s happening right now

The Feed runs all day — short, verified briefs the moment they break.

Open the Feed →
From The Circuitry

Follow @thecircuitry_

Every story we publish, as it happens. No noise between.

Follow on X ↗On Bluesky ↗

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee
More fromopenai.com
  • OpenAI Launches GPT-6.1 Terra at $1/$5 Per Million Tokens, Half Sol's Price

    Tech · 3d
  • OpenAI says GPT-Rosalind agents flagged a cholesterol hypothesis for Perry syndrome gene DCTN1

    Tech · 8d
  • OpenAI says its latest models are far better at COBOL, Fortran and Visual Basic

    Tech · 10d
More inTech
  • CISA Adds Exploited Cisco ASA and FTD VPN Crash Flaw CVE-2026-76418 to KEV

    Tech · 7h
  • CISA Adds Critical GitLab CI/CD Regex Flaw CVE-2026-97229 to Exploited Vulnerabilities List

    Tech · 7h
  • Intel Q3 2026 earnings: $16.5 billion revenue, data center up 78%

    Tech · 7h
SupportThe Work

The Circuitry is reader-supported. If you find the daily brief useful, you can buy me a coffee to keep it going.

Buy a coffee →
Ad
From The CircuitryWhy The Circuitry

Verified tech news, cross-checked.

Every story is checked against independent sources before it posts — no rumors dressed up as fact.

How we verify →
From The CircuitryWhy The Circuitry

Verified tech news, cross-checked.

Every story is checked against independent sources before it posts — no rumors dressed up as fact.

How we verify →

MORE IN THIS BEAT

All Tech →
  • Tech·Oct 29

    DoorDash agrees to acquire Instacart for about $17 billion

    DoorDash and Instacart parent Maplebear announced a definitive agreement under which DoorDash will acquire Instacart for $65 per share, an equity value of about $17 billion.

  • Tech·Oct 29

    Intel shares plunge after hours as Israel fab blast and PC slowdown weigh on outlook

    Intel shares fell 14% in after-hours trading on Oct. 29, per Reuters, with later reports putting the drop at about 17% to more than 20%, after the company guided fourth-quarter revenue below estimates. CFO David Zinsner told Reuters an October explosion at its Kiryat Gat, Israel fab will cut about $600 million of revenue over two quarters.

  • Tech·Oct 29

    Amazon earnings call: AWS backlog reaches $578 billion, 2027 spending to rise "meaningfully"

    On Amazon's third-quarter earnings call, CEO Andy Jassy said AWS has a $578 billion backlog of contracted future revenue, more than double a year earlier, and that Amazon expects to spend meaningfully more on capital projects in 2027 than the roughly $220 billion planned for 2026.

  • Tech·Oct 29

    Rivian R2 becomes company’s top-selling vehicle in Q3

    Rivian’s R2 was the company’s best-selling vehicle by volume in the third quarter, though Rivian did not disclose R2 unit counts. Revenue rose 38% to $2.155 billion, software and services revenue rose 45% to $605 million, and the automotive gross loss narrowed year over year.

  • Tech·Oct 29

    Reddit to require login for all users, starting with tests outside US

    According to CEO Steve Huffman, Reddit will require users to log in to browse the site, beginning with tests in select markets outside the US. The change aims to curb scraping and support advertising.