OpenAI AI model spots major PHP security gaps affecting most of the web

OpenAI announced on Tuesday that its advanced AI model, GPT-5.6 Sol, played a key role in identifying serious security weaknesses in PHP, the open-source language that powers an estimated 70% of the internet. The discovery emerged from the company's Patch the Planet cybersecurity initiative, which brings together experts and AI tools to hunt down digital vulnerabilities before they can be widely abused.

The flaws were not new to the PHP Foundation, which had known about the underlying issue since 2024. However, human developers had struggled to find a way to exploit the bug or to fix it. The situation changed when researchers from Calif, a California-based security firm and founding partner in the Patch the Planet program, began auditing PHP with OpenAI tools on July 30 of this year. By August 11, they had identified a method to turn that old flaw into an active threat.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, involve problems in how PHP manages computer memory and handles errors. In one case, if the system runs out of allocated memory during a request, it may leave behind incomplete data that the engine later mistakes for valid information. In the other, a fatal error can leave the system pointing to memory that has already been freed, allowing later requests to access or corrupt it.

Both issues carry a critical severity score of 9.2 out of 10. Because they exist in PHP's core engine, websites can be affected even if their specific application code is secure. Attackers can potentially exploit these weaknesses remotely without needing login credentials, which could allow them to execute malicious code and take control of affected servers. The researchers also demonstrated that the flaws could expose sensitive data stored in server memory, such as passwords and API keys.

In response, the PHP Foundation released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. These updates were originally scheduled for Wednesday, October 22, but were brought forward to Tuesday, October 21, after details leaked online on Monday, October 20, causing public concern. Older versions, specifically PHP 8.1 and earlier, will not receive official fixes, meaning users on those versions need to upgrade to a supported release to stay safe.

OpenAI describes this incident as a prime example of what it calls the Defender's Window. This concept refers to a narrow timeframe where organizations can use frontier AI models to find and patch defenses before those same capabilities become widely available to attackers. The company argues that powerful technology will inevitably be used by bad actors, so it is a collective responsibility to act proactively. This view follows recent reports that Anthropic's Claude Mythos identified thousands of zero-day vulnerabilities in major operating systems and browsers.

The timeline of the fix highlights the complexity of the task. It took two months to coordinate a coalition of researchers, maintainers, and government agencies to implement the necessary changes to the PHP engine. While human teams had examined the code for two years without resolving the flaw, AI-assisted researchers demonstrated practical exploits within just two weeks. This speed underscores the shifting dynamics of cybersecurity, where AI is rapidly changing how vulnerabilities are found and addressed.