AI Models Expose Long-Standing PHP Flaws Affecting Majority of Web

The web’s backbone relies heavily on a single programming language, and that foundation just hit a major security snag. OpenAI announced on October 21 that its AI model, GPT-5.6 Sol, helped identify critical vulnerabilities in PHP, the open-source language estimated to run 70% of the internet. This discovery marks a significant moment in cybersecurity, showcasing how artificial intelligence is transforming the way developers find and fix deep-rooted code issues.

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, stem from errors in how PHP manages memory and handles fatal errors. Specifically, the first issue occurs when the system runs out of allocated memory during a request, potentially leaving behind incomplete data that the engine mistakenly treats as valid later. The second involves a fatal error causing PHP to point to memory that has already been freed, allowing subsequent requests to access or corrupt that space. Both vulnerabilities received a critical severity score of 9.2 out of 10, indicating a high risk of remote exploitation without the need for login credentials.

Researchers from Calif, a California-based cybersecurity firm and founding partner in OpenAI’s “Patch the Planet” initiative, began auditing PHP on July 30, 2026. Although the PHP Foundation had known about the underlying flaw since 2024, human developers had been unable to identify a working exploitation method or a fix. That changed on August 11, when Calif researcher Ryan A. and OpenAI’s team simultaneously identified the exploitable vulnerability. Shortly after, another firm, Wiz, independently found an additional related weakness.

Once the issues were confirmed, OpenAI coordinated a coalition of PHP maintainers, security providers, and government agencies to develop fixes over the following two months. The company attributed the lengthy timeline to the complexity of the task, which required major changes to the PHP engine. The PHP Foundation ultimately released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to resolve the problems. Sites running PHP 8.1 or older versions will not receive official fixes, meaning they must upgrade to a newer version to stay secure.

The coordinated release was originally scheduled for October 22, but it was brought forward to October 21 after premature disclosures on October 20 sparked public outcry. OpenAI highlighted this incident as a prime example of its “Defender’s Window” concept, a term introduced after its models hacked Hugging Face. The concept describes a narrow timeframe where organizations can use advanced AI to find and patch defenses before those same AI-driven attack capabilities become widely available to malicious actors.

The AI-assisted researchers demonstrated that these flaws could expose sensitive information stored in server memory, including passwords, authentication tokens, and API keys. Most concerning is that the vulnerabilities exist in PHP’s core engine, meaning websites can be affected even if their specific application code is secure. While some argue the flaws would have remained harmless without AI to exploit them, OpenAI maintains that it is a collective responsibility to act proactively, noting that Anthropic’s Claude Mythos has recently identified thousands of similar zero-day vulnerabilities across major operating systems and browsers.

For users in the Mid-Atlantic and beyond, the immediate takeaway is clear: if you manage a website, check your PHP version. Upgrading to the latest patched releases is now the safest way to protect against these remote attacks, ensuring your digital infrastructure remains resilient in an increasingly AI-driven threat landscape.