PHP Security Patch: AI Finds Critical Flaw Affecting 70% of Web
Researchers used an AI model to turn a long-standing PHP bug into a working exploit, prompting urgent updates for a large portion of the internet.
By Lauren Bello ·
Seventy percent of the web runs on PHP, a programming language that has just undergone a significant security shakeup. OpenAI announced on October 21 that its GPT-5.6 Sol model helped identify critical vulnerabilities in the language. The discovery has led to immediate patched versions being released to protect millions of websites from potential remote attacks.
The core issue involves how PHP handles computer memory. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, create situations where the system might use data that has already been freed or misread incomplete internal data. Under specific conditions, attackers could exploit these weaknesses without needing login credentials. This could allow them to execute malicious code and take control of affected servers.
The PHP Foundation has released version 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the problems. Sites running PHP 8.1 or older will not receive official fixes. The release was originally planned for October 22, but it was moved up to October 21 after early disclosures on October 20 caused public concern. OpenAI stated that all sites using PHP can safely upgrade to the new versions to maintain security.
The timeline of the discovery is notable. The PHP Foundation had been aware of the underlying flaw since 2024 but could not figure out how to exploit it or fix it. Human developers struggled for two years. In contrast, researchers using AI tools demonstrated practical exploits within just two weeks. This rapid progress highlights a shift in how cybersecurity vulnerabilities are found and addressed.
The work was conducted under the Patch the Planet cybersecurity initiative. Researchers from Calif, a California-based firm and founding partner of the program, began auditing PHP on July 30, 2026. Ryan A., a researcher at Calif, identified the exploitable vulnerability on August 11. OpenAI researchers confirmed it the same day. Another firm, Wiz, also independently found an additional vulnerability during the process.
OpenAI frames this incident as an example of the Defender's Window concept. This idea suggests there is a narrow timeframe where organizations can use advanced AI models to find and patch defenses before bad actors can use the same tools for attacks. The company argues that powerful technology will inevitably be used by attackers, so it is a collective responsibility to fix potential flaws proactively.
The severity of the bug is underscored by its location. The vulnerabilities exist in the core PHP engine, meaning websites can be affected even if their own application code is secure. Both flaws received a critical severity score of 9.2 out of 10. The AI tools also showed that the bugs could expose sensitive data stored in server memory, such as passwords, authentication tokens, and API keys.
There is some debate about the real-world impact. One perspective is that the flaws were not a major threat because they were not easily exploitable without AI assistance. However, OpenAI challenges this view, noting that Anthropic's Claude Mythos recently found thousands of zero-day vulnerabilities in major operating systems and browsers. This supports the argument that AI-driven discovery is becoming a standard part of the cybersecurity landscape.
For users and developers in California and elsewhere, the message is clear. If you manage a website running PHP, you should check your version immediately. Upgrading to the latest patched version is the recommended step to secure your infrastructure. The incident serves as a reminder that the tools used to find bugs are evolving rapidly, and staying current is essential.
