{"version":1,"type":"story","url":"https://digestai.news/story/openai-assists-in-discovering-php-and-brotli-vulnerabilities-report-sa","json":"https://digestai.news/story/openai-assists-in-discovering-php-and-brotli-vulnerabilities-report-sa.json","markdown":"https://digestai.news/story/openai-assists-in-discovering-php-and-brotli-vulnerabilities-report-sa.md","slug":"openai-assists-in-discovering-php-and-brotli-vulnerabilities-report-sa","headline":"OpenAI assists in discovering PHP and Brotli vulnerabilities, report says","summary":"On October 21 the PHP development team disclosed two critical remote‑code‑execution flaws, CVE‑2026‑109618 and CVE‑2026‑109619, dubbed “PHP2Shell.” OpenAI’s explanation says a researcher identified the bugs using “GPT‑5.6 Sol,” while the security firm Wiz also reported them. OpenAI and other partners provided technical support and coordinated pre‑disclosure, but the patches – PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 – were issued by the PHP team.\n\nA related issue surfaced on October 23 in the Brotli decompression library (CVE‑2026‑111497). The flaw misclassifies malformed data as “insufficient input,” leading to a buffer‑overrun that could cause crashes or remote code execution. Fixed Brotli core versions are 1.0.10, 1.1.1 and 1.2.1; Node.js incorporated these in releases 22.23.4, 24.22.1 and 26.12.1, while Python users must upgrade the Brotli package to 1.2.1 or later. OpenAI’s Codex Security program has listed dozens of similar AI‑aided disclosures across software such as OpenSSH, GnuTLS and browsers.\n\nDevelopers are urged to check their PHP, Node.js and Python environments, apply the updates, and restart services. The article highlights how AI can accelerate vulnerability research but still relies on human verification before patches reach production.","keyPoints":["PHP disclosed CVE‑2026‑109618 and CVE‑2026‑109619 on Oct 21; OpenAI’s GPT‑5.6 Sol helped identify them","Brotli decoder flaw CVE‑2026‑111497 fixed in core 1.0.10, 1.1.1, 1.2.1 and Node.js 22.23.4, 24.22.1, 26.12.1","OpenAI’s Codex Security program reported dozens of AI‑aided bugs in software like OpenSSH, GnuTLS and browsers"],"whyItMatters":"These flaws affect core web‑runtime components; timely patches prevent remote code execution, and the AI‑assisted discovery model shows a new collaborative approach to software security.","category":{"slug":"research","name":"Research","url":"https://digestai.news/category/research"},"entities":{"companies":["OpenAI","PHP development team","Node.js","Google","Trail of Bits","OpenJS Foundation"],"models":["GPT-5.6 Sol"],"people":["Calif","Wiz","Khai Tran","Sylvie Mayer"]},"firstPublishedAt":"2026-10-25T06:39:00Z","updatedAt":"2026-10-25T06:39:00Z","sourceCount":1,"hasPrimarySource":false,"sources":[{"outlet":"note.com","title":"After PHP comes Brotli. Vulnerabilities found by OpenAI and the homework for AI-assisted developers","url":"https://note.com/curegorira35/n/n578e20c42d78?hl=en","publishedAt":"2026-10-25T06:39:00Z","type":"press","primary":false,"lead":true}],"sourceNotes":null,"discussions":[],"thread":null,"cite":{"text":"Digest AI, \"OpenAI assists in discovering PHP and Brotli vulnerabilities, report says\", 25 October 2026, https://digestai.news/story/openai-assists-in-discovering-php-and-brotli-vulnerabilities-report-sa","publisher":"Digest AI","title":"OpenAI assists in discovering PHP and Brotli vulnerabilities, report says","datePublished":"2026-10-25T06:39:00Z","url":"https://digestai.news/story/openai-assists-in-discovering-php-and-brotli-vulnerabilities-report-sa"},"generatedBy":"Written by Digest AI's editorial model from the linked sources; the sources are the record.","license":"Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse"}