Sources: the vendor's own pages (linked above) and creator videos at the linked timestamps. EU status is information, not legal advice; see how we check.
PHP2Shell is the name given to two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in the PHP programming language that could allow remote code execution. According to YouTube coverage, OpenAI used GPT-5.6 to identify the flaw. The vulnerability reportedly exists in PHP versions going back about 20 years, including many that are no longer supported.
The Verge reports that PHP is used by a large share of websites and powers platforms such as WordPress, Drupal and Wikipedia. Security firm Wiz described the flaws as among the most severe discovered in software history. Amazon Threat Intelligence reported an exploitation attempt on October 17, days before the patch. The PHP Foundation said it knew of no successful remote code execution attempt, but stressed that updating is imperative.
Several sites, including the Internet Archive, DeviantArt and 4chan, were briefly taken offline to patch. Some legacy services built on old PHP versions that cannot be updated have shut down. A tool for checking vulnerable PHP versions was reportedly shared. This entry covers a research finding and security event, not a product users can sign up for. Details on the discovery method come mainly from secondary reporting.
Watch the moment: the exact second top creators show it. Videos load only when you press play, via youtube-nocookie.com.
OpenAI used GPT-5.6 to identify a 20-year-old PHP vulnerability before attackers did and shared a tool to check vulnerable PHP versions. Exploitation attempts surged after announcement and some sites went down to patch.
Closest neighbours by meaning, not just by category.
Model · OpenAI
OpenAI cybersecurity model for finding and validating exploitable vulnerabilities, with access limited to vetted defenders.
Model · OpenAI
OpenAI's GPT-5.6 Sol frontier model, with an Ultrafast API tier on Cerebras reaching up to 750 output tokens per second.
Model · OpenAI
OpenAI's internal red-teaming model trained via self-play to discover prompt-injection attacks; not publicly released.
Agent · OpenAI
OpenAI's cybersecurity program offering vetted access to AI models and Codex Security for vulnerability defense and red teaming.
App · OpenAI
OpenAI cloud-based security agent that scans code for vulnerabilities and reports findings.
Model · OpenAI
OpenAI's GPT-6.1 Sol: near-GPT-6 Astra performance on coding and agent tasks at one-fifth of Astra's API price.
