AI Finds Critical PHP Security Flaws

OpenAI announced on October 21 that its GPT-5.6 Sol model helped identify critical security weaknesses in the PHP programming language. The discovery occurred under the company's Patch the Planet cybersecurity initiative. Researchers utilized the AI to analyze code that human developers had struggled to secure for two years. The findings led to a rapid coordination effort among PHP maintainers and security agencies to deploy fixes across the web infrastructure.

The vulnerabilities affect an estimated 70% of the internet. Two specific flaws, designated CVE-2026-109618 and CVE-2026-109619, both received a critical severity score of 9.2 out of 10. These issues reside in how the PHP engine manages memory and processes errors. The widespread nature of the language means the potential impact is significant for server administrators worldwide. The quick response was necessary to mitigate the risk before the details became too public.

Calif, a California-based cybersecurity firm and founding partner of the Patch the Planet program, initiated the audit at the request of the PHP Foundation. The team began using OpenAI tools on July 30, 2026. Ryan A, a researcher at Calif, first identified an exploitable vulnerability on August 11. OpenAI researchers confirmed the finding that same day. Wiz, another cybersecurity firm, independently discovered a second related vulnerability. This collaborative effort highlighted the growing role of AI in detecting complex software bugs that elude traditional manual code reviews.

The PHP Foundation released patched versions to address the issues. Users can now upgrade to versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12. The Foundation stated that versions 8.1 and older will not receive official fixes. The coordinated release was originally planned for October 22. However, premature disclosures on October 20 caused public concern. As a result, the timeline was moved up to October 21 to ensure all users had access to the secure updates as soon as possible.

The first flaw occurs when PHP runs out of allocated memory during a request. This can leave incomplete internal data that the engine mistakenly treats as valid later. The second issue involves a fatal error that leaves the system pointing to memory that has already been freed. Subsequent requests can then access or corrupt this memory. Attackers can exploit these weaknesses remotely without login credentials. This allows them to execute malicious code and potentially take control of affected servers.

Researchers demonstrated that the bugs could expose sensitive data stored in server memory. This includes passwords, authentication tokens, and API keys. Because the flaws exist in the core engine, websites are vulnerable even if their own application code is secure. This distinction makes the discovery particularly concerning for organizations that rely on standard PHP implementations without extensive custom security measures. The ability to extract data without direct access to the source code adds a new layer of risk.

OpenAI described this incident as an example of the Defender's Window concept. The company introduced this idea after its models were used to hack Hugging Face. The concept refers to a narrow timeframe where organizations can use advanced AI to find and patch defenses. This must happen before the same AI capabilities become widely available to threat actors. OpenAI argues that it is a collective responsibility to act proactively. The company noted that Anthropic's Claude Mythos recently identified thousands of zero-day vulnerabilities in major operating systems and browsers.

The timeline of the discovery underscores the speed of AI-assisted research. Human developers knew about the underlying flaw since 2024 but could not find an exploitation method. They also could not devise a fix. AI-wielding researchers demonstrated practical exploits within two weeks of starting the audit. OpenAI attributes the two-month fix timeline to the complexity of the required changes to the PHP engine. The company believes that powerful technology will inevitably be used by bad actors, making proactive defense essential.