AI models expose deep flaws in PHP code used by most websites

The internet runs on a specific piece of software that powers roughly 70% of all websites, and that software has just undergone a major security overhaul. OpenAI announced on Oct. 21 that its advanced AI model, GPT-5.6 Sol, helped identify two critical vulnerabilities in PHP, the open-source language behind a vast portion of the web. These flaws allow attackers to take control of servers without needing login credentials, a discovery that has prompted an urgent update for developers across California and beyond.

The bugs, tracked as CVE-2026-109618 and CVE-2026-109619, stem from how PHP handles memory and errors. One issue occurs when the system runs out of memory, leaving behind incomplete data that the engine might later mistake for valid instructions. The other happens when a fatal error causes the system to point to memory that has already been freed, allowing later requests to corrupt that space. Both issues carry a critical severity score of 9.2 out of 10 and exist in the core engine, meaning even well-written application code can be vulnerable.

Researchers from Calif, a California-based cybersecurity firm and founding partner of OpenAI’s Patch the Planet initiative, began auditing the code on July 30, 2026. The PHP Foundation had known about the underlying flaw since 2024 but could not figure out how to exploit it or fix it. On Aug. 11, Calif researcher Ryan A. identified the exploitable path, and OpenAI researchers followed suit that same day. A separate firm, Wiz, independently found a related vulnerability. The AI-assisted team demonstrated working exploits in just two weeks, a task that had stumped human developers for two years.

The PHP Foundation has released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to resolve these issues. Versions 8.1 and older will not receive official fixes. The coordinated release was originally scheduled for Oct. 22 but moved up to Oct. 21 after premature disclosures on Oct. 20 caused public concern. OpenAI notes that the two-month timeline for the fix was necessary because the changes required significant modifications to the PHP engine itself.

OpenAI frames this discovery as a real-world example of its Defender’s Window concept. This idea suggests there is a narrow timeframe where organizations can use frontier AI to strengthen defenses before those same AI capabilities become widely available to attackers. The company argues that since powerful technology will inevitably be used by bad actors, it is a collective responsibility to act proactively. This view contrasts with the argument that flaws are only dangerous if they are exploitable, a debate that has gained traction since Anthropic’s Claude Mythos identified thousands of zero-day vulnerabilities in major operating systems and browsers.

The incident highlights the shifting landscape of cybersecurity, where AI tools are finding gaps that human teams overlook. For website owners, the immediate next step is to upgrade to the latest patched version of PHP to ensure security. As AI models continue to evolve, the speed at which vulnerabilities are found and fixed may become a defining factor in digital safety.