AI Cracks Two-Year-Old PHP Bug, Exposing Two-Thirds of the Web to Critical Risk

The digital infrastructure of the modern web received a jolt on Tuesday when OpenAI confirmed that its latest AI model, GPT-5.6 Sol, had helped uncover two critical security flaws in PHP. The announcement, released on October 21, reveals that these vulnerabilities affect an estimated 70% of all websites, prompting an emergency release of patched software versions just one day earlier than originally planned.

The urgency stems from the fact that the underlying code flaw had been known to the PHP Foundation since 2024, yet human developers had struggled for two years to find a way to exploit it or fix it. OpenAI states that researchers working under its “Patch the Planet” initiative used the Sol model to transform this dormant bug into working exploits in a mere two weeks. This rapid progression led to a coordinated effort involving PHP maintainers, security providers, and government agencies to implement the necessary changes over the following two months.

The first key point of concern is the nature of the vulnerabilities themselves, tracked as CVE-2026-109618 and CVE-2026-109619. These flaws reside in PHP’s core engine, meaning that even websites with perfectly secure application code can be compromised. The issues involve memory management errors: one occurs when the engine runs out of allocated memory, leaving incomplete data that is later treated as valid, while the other involves a fatal error leaving the system pointing to freed memory. Both allow remote attackers to execute malicious code without needing login credentials.

The second key point involves the scope of the potential damage. Researchers demonstrated that these weaknesses could expose sensitive data stored in server memory, including passwords, authentication tokens, and API keys. Because the flaws are so deeply embedded in the language, they carry a critical severity score of 9.2 out of 10. The PHP Foundation has now released versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the issues, though older versions like 8.1 will not receive official fixes, leaving those users vulnerable.

The third key point highlights the role of AI in accelerating the discovery process. The audit began on July 30 at the request of the PHP Foundation. On August 11, a researcher from the cybersecurity firm Calif identified an exploitable vulnerability, with OpenAI researchers confirming it the same day. Shortly after, another firm, Wiz, independently found an additional flaw. This timeline illustrates the speed at which AI-assisted teams can move from theoretical knowledge to practical exploitation.

Contextualizing this event, OpenAI frames the incident as a prime example of its “Defender's Window” concept. This theory suggests that there is a narrow timeframe during which organizations can use advanced AI to patch defenses before threat actors gain similar capabilities. The company argues that since powerful technology will inevitably be used by bad actors, it is a collective responsibility to act proactively. This follows a recent instance where Anthropic’s model identified thousands of zero-day vulnerabilities across major operating systems and browsers.

The timeline of the release was also influenced by external factors. The coordinated patch was originally scheduled for October 22, but premature disclosures on October 20 triggered public outcry, forcing the release forward by a day. OpenAI now advises that any site using PHP should upgrade to the latest version to ensure security. The incident is being viewed by the company as one of the most significant cybersecurity discoveries of 2026, given the ubiquity of the PHP language.

Looking ahead, the situation raises questions about the future of software security. While some argue that flaws requiring AI to exploit are effectively harmless, OpenAI maintains that the ability to find and fix these issues is a critical advantage. As AI models become more sophisticated, the window for defenders to stay ahead of attackers may continue to narrow, making proactive, AI-assisted audits a standard practice for maintaining the integrity of the open-source ecosystem.