AI Tools Expose Decade-Old PHP Flaws Affecting Most of the Web

The internet’s most ubiquitous programming language just received its most critical security update in years.

OpenAI announced on Wednesday that its GPT-5.6 Sol model played a pivotal role in uncovering deep-seated vulnerabilities within PHP, the open-source engine powering an estimated 70% of the web. Under the company’s “Patch the Planet” cybersecurity initiative, researchers collaborated with the PHP Foundation, security providers, and government agencies to remediate the issues. The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, stem from errors in how PHP manages memory and processes fatal conditions. When the system runs out of allocated memory or encounters a fatal error, it can leave behind incomplete data or pointers to freed memory. Under specific conditions, attackers can exploit these weaknesses remotely to execute malicious code or steal sensitive data like passwords and API keys, all without needing login credentials.

The discovery timeline highlights a stark contrast between human and AI-driven security efforts. The PHP Foundation had been aware of the underlying code anomaly since 2024 but failed to identify a practical exploitation method or a fix. Human developers examined the code for two years without success. The situation changed in late July when Calif, a California-based cybersecurity firm and founding partner of the Patch the Planet program, began auditing PHP with OpenAI’s tools at the Foundation’s request. On August 11, Calif researcher Ryan A. identified the exploitable vulnerability. OpenAI researchers confirmed the finding the same day. A second firm, Wiz, independently identified a related vulnerability shortly after. While human experts struggled for two years, the AI-assisted team demonstrated working exploits within just two weeks.

The release of patched versions for PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 was originally scheduled for Thursday, October 22. However, premature disclosures on October 20 triggered public concern, prompting the coalition to move the coordinated release forward to Wednesday. Older versions, including PHP 8.1, will not receive official fixes, meaning sites running those versions must upgrade to remain secure. Both vulnerabilities carry a critical severity score of 9.2 out of 10. OpenAI describes this incident as a prime example of its “Defender’s Window” concept. This theory posits that there is a narrow timeframe where organizations can use frontier AI models to find and patch flaws before those same capabilities become widely available to malicious actors. The company argues that while AI will inevitably be used by attackers, it is a collective responsibility to act proactively to close these gaps.

The incident underscores the rapid evolution of cybersecurity in 2026. OpenAI notes that similar AI-driven discoveries have been made elsewhere, citing Anthropic’s recent identification of thousands of zero-day vulnerabilities in major operating systems and browsers. For the roughly 70% of websites relying on PHP, the message is clear: the era of manual code auditing is giving way to AI-accelerated threat detection. Administrators must now prioritize upgrading to the latest patched versions to protect their infrastructure from exploits that previously seemed impossible to execute.