PHP Security: AI Finds Flaws Affecting 70% of Web

Seventy percent of the internet runs on PHP, a figure that underscores the massive scale of the security threat uncovered earlier this month. OpenAI announced on October 21 that its GPT-5.6 Sol model helped researchers discover critical vulnerabilities in the open-source programming language. The discovery was part of the company’s “Patch the Planet” cybersecurity initiative, which aims to leverage advanced AI to fortify digital infrastructure before malicious actors can exploit similar weaknesses.

The technical details of the flaws reveal serious issues in how PHP manages computer memory and processes errors. Tracked as CVE-2026-109618 and CVE-2026-109619, both bugs carry a critical severity score of 9.2 out of 10. The first vulnerability occurs when PHP exhausts its allocated memory during a request, potentially leaving incomplete internal data that the engine later misinterprets as valid. The second involves a fatal error that leaves PHP pointing to memory that has already been freed, allowing subsequent requests to access or corrupt that space.

These weaknesses are particularly dangerous because they reside in PHP’s core engine. This means that even websites with flawless application-level code remain vulnerable. Attackers can exploit these flaws remotely without needing login credentials, potentially executing malicious code to take control of servers. Furthermore, the researchers demonstrated that the bugs could expose sensitive information stored in server memory, including passwords, authentication tokens, and API keys.

The timeline of the discovery highlights a significant shift in cybersecurity dynamics. The PHP Foundation had known about the underlying flaw since 2024, but human developers were unable to identify a working exploitation method or a viable fix for two years. In contrast, researchers using AI tools demonstrated practical exploits within just two weeks of beginning their audit. On July 30, 2026, researchers from Calif, a California-based cybersecurity firm and founding partner of the Patch the Planet program, began auditing PHP at the Foundation's request. By August 11, Calif researcher Ryan A. had identified the exploitable vulnerability, with OpenAI researchers confirming the finding the same day.

The resolution process was complex, requiring major changes to the PHP engine. Consequently, it took two months to coordinate fixes among a coalition of researchers, PHP maintainers, security providers, and government cybersecurity agencies. The PHP Foundation released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the issues. Notably, versions 8.1 and older will not receive official fixes, leaving older installations at higher risk. OpenAI advises that all sites using PHP should upgrade to the latest secure versions immediately.

The official release of the patches was originally scheduled for October 22, but the date was brought forward to October 21. This change was necessitated by premature disclosures on October 20, which triggered public outcry and urgency among system administrators. The accelerated timeline underscores the difficulty of managing critical infrastructure updates when information leaks before the official announcement.

OpenAI positions this incident as a prime example of its “Defender's Window” concept. The company argues that there is a critical, narrow timeframe during which organizations can use frontier AI models to find and patch vulnerabilities before those same capabilities become widely available to malicious threat actors. This view challenges the notion that AI-discovered bugs are harmless if they were not exploitable by humans previously. Instead, OpenAI maintains that it is a collective responsibility to act proactively, given that powerful technology will inevitably be used by bad actors.

The stakes are high, as this incident is considered one of the largest cybersecurity discoveries of 2026. The ubiquity of PHP means that a single core flaw can impact a vast portion of the global web. With other AI models, such as Anthropic’s Claude Mythos, recently identifying thousands of zero-day vulnerabilities in major operating systems and browsers, the pattern suggests that AI-driven discovery is becoming the norm. For Midwest businesses and developers relying on legacy web infrastructure, the message is clear: the era of human-only security audits may be ending, replaced by a faster, AI-assisted cycle of detection and remediation.