PHP patches two critical flaws; Finland, BBC pull services

What happened: PHP issued emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Either could let an attacker run code on a vulnerable server without login credentials.

The details: PHP said every installation serving web requests could be exposed. Patches cover supported versions, per its security advisory. Older, unsupported releases face a harder upgrade path.

Who's affected: Finland temporarily shut down government web services. Edinburgh council and the BBC took pages offline.

The catch: Security agencies advised organisations that couldn't patch quickly to isolate vulnerable systems.

The context: OpenAI said a critical flaw was identified using GPT-5.6 Sol. Wiz independently found both vulnerabilities, according to the notes on the disclosure. OpenAI laid out its account in a coordinated disclosure post.

Why it matters: OpenAI called the gap between AI-assisted discovery and public disclosure a "Defender's Window," in which maintainers can patch before attackers gain the same capabilities.

What's next: Organisations running PHP on web-facing servers need to apply the patches or isolate affected systems. This account comes via a secondary summary from The Neuron, and the OpenAI and PHP pages were not read directly, so details remain unconfirmed.