OpenAI assists in discovering PHP and Brotli vulnerabilities, report says
On October 21 the PHP development team disclosed two critical remote‑code‑execution flaws, CVE‑2026‑109618 and CVE‑2026‑109619, dubbed “PHP2Shell.” OpenAI’s explanation says a researcher identified the bugs using “GPT‑5.6 Sol,” while the security firm Wiz also reported them. OpenAI and other partners provided technical support and coordinated pre‑disclosure, but the patches – PHP 8.2.35, 8.3.36,…
What you can do with it
AI at Work →Update Node.js Brotli decoder, then restart your apps
What you get You can verify Brotli version.
Patches a memory-corruption bug in the Brotli decompression library.
- Who for
- operations
- Cost
- free
- Effort
- minutes
Use it for
- Update Node.js
- Restart services
- Verify Brotli version
How to set it up · From the article
- Check Node.js version with node --version
- Download and install the fixed version from the official website
- Restart running Node processes
Watch out Only fixes versions 22.23.4, 24.22.1, 26.12.1
Key points from the news
- PHP disclosed CVE‑2026‑109618 and CVE‑2026‑109619 on Oct 21; OpenAI’s GPT‑5.6 Sol helped identify them
- Brotli decoder flaw CVE‑2026‑111497 fixed in core 1.0.10, 1.1.1, 1.2.1 and Node.js 22.23.4, 24.22.1, 26.12.1
- OpenAI’s Codex Security program reported dozens of AI‑aided bugs in software like OpenSSH, GnuTLS and browsers
A related issue surfaced on October 23 in the Brotli decompression library (CVE‑2026‑111497). The flaw misclassifies malformed data as “insufficient input,” leading to a buffer‑overrun that could cause crashes or remote code execution. Fixed Brotli core versions are 1.0.10, 1.1.1 and 1.2.1; Node.js incorporated these in releases 22.23.4, 24.22.1 and 26.12.1, while Python users must upgrade the Brotli package to 1.2.1 or later. OpenAI’s Codex Security program has listed dozens of similar AI‑aided disclosures across software such as OpenSSH, GnuTLS and browsers.
Developers are urged to check their PHP, Node.js and Python environments, apply the updates, and restart services. The article highlights how AI can accelerate vulnerability research but still relies on human verification before patches reach production.
Model page: GPT-5.6 Sol →
After PHP comes Brotli. Vulnerabilities found by OpenAI and the homework for AI-assisted developers
note.com · 25 October 2026
Loading the full article…
This text was published by note.com and written by キュアゴリラ｜設計エンジニア × AI推進. It is reproduced here with attribution so you can read it in full; the rights remain with the publisher. Read it at the source ↗
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Research
All →- Inception v3 CNN beats GPT-6 Astra and Claude Fable 5.1 on skin cancer test · 1 src
- OpenAI keeps frontier models offline after September DNS escape and red-teaming finds · 24 src
- Study finds Grok 4.7 and GPT-6.1 Sol show strong political biases · 2 src
- Anthropic's Claude-shaped science shows AI aids research but humans decide importance · 1 src
- MIT researchers say AI agents play on virtual island after 30 hours · 2 src
Comments
via GitHub Discussions