Last August, a group of researchers using OpenAI’s cutting-edge GPT-5.6 Sol AI model discovered two remote code execution vulnerabilities in the PHP engine that had been present for years. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and collectively known as “PHP2Shell,” could allow attackers to take full control of a website and carry out any type of action.