# PHP patches two critical flaws; Finland, BBC pull services

> Two critical PHP flaws forced emergency patches and took Finnish government and BBC web pages offline.

*CVE-2026-109618 and CVE-2026-109619 could let attackers run code on a vulnerable server without credentials, and one was found using OpenAI's GPT-5.6 Sol.*

By Bez · FeaturedDaily
Canonical: https://featureddaily.com/news/php-patches-two-critical-flaws-finland-bbc-pull-services

**What happened:** PHP issued emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Either could let an attacker run code on a vulnerable server without login credentials.

**The details:** PHP said every installation serving web requests could be exposed. Patches cover supported versions, per its [security advisory](https://www.php.net/archive/2026.php#2026-10-21-5). Older, unsupported releases face a harder upgrade path.

**Who's affected:** Finland temporarily shut down government web services. Edinburgh council and the BBC took pages offline.

**The catch:** Security agencies advised organisations that couldn't patch quickly to isolate vulnerable systems.

**The context:** OpenAI said a critical flaw was identified using GPT-5.6 Sol. Wiz independently found both vulnerabilities, according to the notes on the disclosure. OpenAI laid out its account in a [coordinated disclosure post](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/).

**Why it matters:** OpenAI called the gap between AI-assisted discovery and public disclosure a "Defender's Window," in which maintainers can patch before attackers gain the same capabilities.

**What's next:** Organisations running PHP on web-facing servers need to apply the patches or isolate affected systems. This account comes via a secondary summary from The Neuron, and the OpenAI and PHP pages were not read directly, so details remain unconfirmed.

## Key takeaways

- Two PHP flaws allow code execution without login credentials.
- Finland, Edinburgh council and the BBC took services or pages offline.
- OpenAI says GPT-5.6 Sol helped find one; Wiz found both.

## Sources

- [Coordinated disclosure of critical vulnerabilities](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/) — OpenAI, 2026-10-22
- [PHP security advisory](https://www.php.net/archive/2026.php#2026-10-21-5) — PHP.net, 2026-10-21