Wiz

Overview

Wiz is a cloud-security vendor whose AI-assisted vulnerability research pipeline surfaced in the 2026-10-21 Patch the Planet disclosure cycle. Wiz independently reported the same critical PHP RCE that OpenAI credits GPT-5.6 Sol for discovering — Wiz’s finding came through using Google‘s Gemini 4 Argon, making the Oct 21 patch the first publicly recorded AI-assisted CVE confirmed across two labs’ research pipelines on different frontier models.

Timeline

• 2026-10-22-AI-Digest — Wiz independently reported the critical PHP flaw patched Oct 21 under OpenAI‘s Patch the Planet program, using Gemini 4 Argon in its AI-assisted research pipeline. The joint discovery confirms the finding across two labs’ AI-assisted pipelines; Fortune’s more dramatic framing (PHP2Shell naming, country-outage lists, Cloudflare same-day attacker-exploitation claim) did not corroborate independently — the first-party-confirmable core is the OpenAI + Wiz joint discovery under Patch the Planet. Log against MOC - Agent Security.

Key Developments

1. First AI-Assisted CVE Confirmed Across Two Labs on Different Frontier Models (October 21, 2026): Wiz using Gemini 4 Argon and OpenAI using GPT-5.6 Sol independently reported the same critical PHP RCE patched Oct 21 under Patch the Planet. Load-bearing framing to carry: the Oct 21 batch disclosure is the latest in a running series of AI-assisted CVE discoveries now reaching higher-blast-radius software, not the first AI-discovered CVE — Google’s Big Sleep shipped the SQLite CVE-2025-6965 in October 2024, and Patch the Planet itself (launched June 2026) had already surfaced Firefox WebAssembly and dnsmasq CVEs. What is new today is the cross-lab, cross-model independent confirmation on the same PHP flaw.

Related

See also: OpenAI, Google, GPT-5.6 Sol, Gemini 4 Argon, Patch the Planet, MOC - Agent Security.