THE SHORT VERSION
● The claim — GPT-5.6 Sol identified a critical flaw in the php2shell pair
● Corroboration — Wiz independently found both CVEs
● New framing — OpenAI calls the pre-disclosure gap the Defender's Window
● The test — that window closed a day early when the flaws leaked
OpenAI says a critical flaw among the php2shell pair — CVE-2026-109618 and CVE-2026-109619, both rated 9.2 — was identified using GPT-5.6 Sol, and security firm Wiz independently found both. Those two facts sitting next to each other are the story: a model and a specialist human team reached the same bugs in the same window, which is the first genuinely useful datapoint about where AI-assisted vulnerability research sits. Not ahead of the best humans, not behind them.
OpenAI has started using the phrase Defender's Window for the interval between an AI-assisted discovery and public disclosure: the model finds it, the vendor gets it, a patch gets built, and defenders get a head start. The php2shell timeline tested that argument badly. A post claiming the flaws were headed for disclosure appeared on 20 October and was pulled after screenshots spread; watchTowr confirmed the leak was real against an embargo set for Thursday 11am ET; PHP moved its release forward a full day to 21 October at 14:00 UTC; and national agencies across Europe pulled public services offline rather than run unpatched. The Defender's Window worked right up until a forum post ended it early.
The optimistic read is that models finding real memory-corruption bugs in widely deployed C code are a durable advantage for defenders, because they can run continuously across a codebase in a way no human team can afford. The pessimistic read sits in the same sentence — a capability that finds these flaws does not care who runs it, and the asymmetry defenders enjoy comes from access and disclosure norms rather than from the capability. What is new in 2026 is not AI-assisted bug hunting but this combination: a CVSS 9.2 pre-authentication RCE in a runtime behind roughly 70% of the web, named publicly by the lab and corroborated by an independent firm. If you maintain a C or C++ codebase of any size, model-assisted auditing has moved from interesting to worth budgeting.
Sources
The Neuron daily digest · PHP.net advisory · Huntress