OpenAI AI Finds Critical Flaws in PHP Powering 70% of Web
Researchers used GPT-5.6 Sol to exploit two memory bugs that stumped human developers for two years.
By Arjun Patel ·
Seventy percent of the internet runs on a single piece of code that is now known to have critical holes in it. This is the scale of the issue facing web developers worldwide. The programming language PHP, which powers a vast majority of sites, contains two severe security flaws. These vulnerabilities could allow attackers to take control of servers without any login credentials. The discovery highlights a new era in cybersecurity where artificial intelligence finds problems humans miss.
The timeline of this event stretches back further than the recent headlines suggest. The PHP Foundation first identified the underlying flaw in 2024. For two years, human developers looked at the code but could not find a way to exploit it or fix it. They were stuck. The situation changed in July 2026. The Foundation asked researchers from a California-based firm called Calif to audit the language. They began their work on July 30 using tools from OpenAI.
On August 11, the team identified the first exploitable vulnerability. OpenAI researchers confirmed the finding the same day. Another security firm, Wiz, independently found a second related issue. These two bugs are tracked as CVE-2026-109618 and CVE-2026-109619. They both stem from how PHP manages memory and handles errors. When the system runs out of memory, it can leave behind incomplete data. The engine might later mistake this junk for valid information.
The second bug is a bit more specific. A fatal error can leave the system pointing to memory that has already been freed. Subsequent requests can then access or corrupt this space. Under the right conditions, attackers can exploit these weaknesses remotely. They do not need to be logged in. They can execute malicious code on affected servers. This could lead to full control of a website. The flaws can also expose sensitive data like passwords and API keys stored in server memory.
Both vulnerabilities carry a critical severity score of 9.2 out of 10. This is near the top of the scale. The bugs exist in the core engine of PHP. This means a website can be affected even if its specific application code is secure. The problem is deep in the foundation. OpenAI describes this incident as one of the biggest cybersecurity discoveries of 2026. It serves as a prime example of what they call the Defender's Window.
The Defender's Window is a concept OpenAI introduced earlier this year. It refers to a narrow timeframe when organizations can use advanced AI to find and patch flaws. This must happen before those same AI capabilities become widely available to bad actors. The company argues that powerful technology will inevitably be used by attackers. Therefore, it is a collective responsibility to act proactively. They point to a recent discovery by Anthropic's Claude Mythos, which found thousands of zero-day vulnerabilities in major operating systems and browsers.
The fix was not immediate. OpenAI coordinated a coalition of researchers, maintainers, and government agencies to address the issues. This process took two months. The complexity of the task required major changes to the PHP engine. The PHP Foundation released patched versions on October 21. These include PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Versions 8.1 and older will not receive official fixes. Users on these older versions need to upgrade to be safe.
The release date was originally set for October 22. However, it was brought forward by one day. This shift happened after premature disclosures on October 20 caused public outcry. The urgency reflects the high stakes involved. Human teams had examined the code for two years without a full resolution. AI-wielding researchers demonstrated practical exploits in just two weeks. Some argue the flaws would never have been exploitable without AI, making them harmless. OpenAI disagrees. They believe proactive defense is essential.
For New England readers, this is a reminder that the digital infrastructure underpinning local businesses is part of a global system. If your website or internal tools rely on PHP, an upgrade is necessary. The patches are available now. The window to protect your systems before the next wave of AI-driven attacks is open. It is a good time to check your version numbers. Security is no longer just about firewalls. It is about keeping up with the pace of discovery.
Source: Tom's Hardware
