PHP Security: AI Model Exposes Flaw Affecting 70% of the Web

Seventy percent of the internet runs on a single programming language, PHP, and that infrastructure is now patched against a critical flaw that had gone unnoticed by human experts for two years. On October 21, OpenAI announced that its GPT-5.6 Sol model, operating under the company’s Patch the Planet initiative, identified severe vulnerabilities in the PHP engine. The discovery triggered a coordinated response involving researchers, maintainers, and government agencies to release fixes for one of the most widespread pieces of code on the web.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, involve fundamental errors in how PHP manages computer memory. The first flaw occurs when the system runs out of allocated memory, potentially leaving behind incomplete data that the engine later misinterprets as valid. The second issue arises when a fatal error causes PHP to point to memory that has already been freed, allowing subsequent requests to access or corrupt that space. Both issues received a critical severity score of 9.2 out of 10.

The PHP Foundation has released updated versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address these issues. Versions 8.1 and older will not receive official fixes. Although the coordinated release was originally scheduled for October 22, it was brought forward to October 21 following premature disclosures on October 20 that led to public concern. OpenAI stated that all sites using PHP can now safely upgrade to secure their systems.

The background of this discovery highlights a significant gap between human and AI capabilities in security auditing. The PHP Foundation had been aware of the underlying flaw since 2024 but could not determine how to exploit it or how to fix it. Human developers and security teams examined the code for two years without a resolution. In contrast, researchers from Calif, a California-based cybersecurity firm and founding partner of the Patch the Planet program, began auditing PHP with OpenAI tools on July 30, 2026. They identified the exploitable vulnerability on August 11, with OpenAI researchers confirming it the same day. A separate firm, Wiz, independently found an additional related vulnerability during this period.

The practical implications of these flaws are substantial. Because the errors reside in PHP's core engine, websites can be affected even if their specific application code is secure. Attackers can exploit these weaknesses remotely without needing login credentials to execute malicious code on affected servers. Furthermore, the researchers demonstrated that these flaws could expose sensitive information stored in server memory, including passwords, authentication tokens, and API keys. This means a single line of code could potentially allow an attacker to take control of a website.

OpenAI frames this incident as a prime example of the 'Defender's Window' concept. The company introduced this idea after its models previously hacked Hugging Face. The concept describes a narrow timeframe during which organizations can use advanced AI models to find and patch defenses before those same AI capabilities become widely available to malicious actors. OpenAI argues that since powerful technology will inevitably be used by bad actors, it is a collective responsibility to act proactively to address exploitable flaws.

The timeline for the fix took two months, a duration OpenAI attributes to the complexity of the task, which required major changes to the PHP engine. The company considers this one of the biggest cybersecurity discoveries of 2026 due to the ubiquity of PHP. While some might argue that the flaws were effectively harmless if they could only be exploited with AI assistance, OpenAI challenges this view by pointing to recent findings by Anthropic's Claude Mythos, which identified thousands of zero-day vulnerabilities in major operating systems and browsers.

For readers in New York and New Jersey, the immediate impact is a reminder that the digital infrastructure powering local businesses and global platforms is constantly being stress-tested by new tools. The shift toward AI-assisted security research is accelerating the pace at which vulnerabilities are found and fixed. As the Patch the Planet initiative continues, the expectation is that such audits will become a standard part of maintaining robust digital defenses.

Looking ahead, the focus will remain on ensuring that all PHP-based services upgrade to the latest patched versions. The collaboration between private firms, the PHP Foundation, and government agencies sets a precedent for how the industry might handle future AI-discovered vulnerabilities. The next step involves monitoring the effectiveness of the patches and continuing the audit process to ensure that no other critical flaws remain hidden in the core engine.