AI Finds Critical Web Flaws
Advanced AI models identified deep-seated PHP security bugs that human experts had missed for two years, forcing a rapid global patch rollout.
By Alina Carter ·
Seventy percent of the internet runs on PHP, a fact that suddenly became the center of a cybersecurity storm this week. That staggering figure represents the sheer volume of websites potentially exposed by two critical vulnerabilities that went unnoticed by human developers for two years. OpenAI announced on October 21 that these flaws, which could allow attackers to take control of servers, were finally uncovered and fixed thanks to the company’s latest AI model, GPT-5.6 Sol. The discovery highlights a shifting landscape in digital security where artificial intelligence is playing a decisive role in hunting down bugs that traditional methods failed to catch.
The situation came to a head after researchers under OpenAI’s “Patch the Planet” initiative identified the issues. The company coordinated a massive effort involving PHP maintainers, security firms, and government agencies to resolve the problems. This process took two months because the fixes required significant changes to the core PHP engine. The PHP Foundation eventually released updated versions, specifically PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. It is important to note that older versions, including PHP 8.1 and below, will not receive official patches, leaving some systems potentially vulnerable unless they upgrade to the newer releases.
Originally, the coordinated release of these fixes was scheduled for October 22. However, the timeline was accelerated to October 21 after premature disclosures leaked on October 20. This early leak triggered public concern, prompting the team to push the official announcement forward by a day. OpenAI stated that any site using PHP can now safely upgrade to these new versions to secure their infrastructure. The company views this incident as one of the most significant cybersecurity findings of 2026, given how ubiquitous PHP is across the web.
The timeline of the discovery began on July 30, 2026, when researchers from Calif, a California-based cybersecurity firm and founding partner of the Patch the Planet program, started auditing PHP using OpenAI tools. This work was initiated at the request of the PHP Foundation. While the foundation had been aware of the underlying flaw since 2024, they were unable to find a way to exploit it or create a fix. On August 11, Calif researcher Ryan A. identified the exploitable vulnerability, and OpenAI researchers independently confirmed the issue later that same day. Another firm, Wiz, also independently found an additional vulnerability during this period.
The two specific vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, stem from how PHP manages computer memory and handles errors. The first issue occurs when PHP runs out of allocated memory during a request, potentially leaving behind incomplete internal data that the engine later mistakes for valid information. The second involves a fatal error that leaves PHP pointing to memory that has already been freed. This allows subsequent requests to access or corrupt that memory. Both flaws carry a critical severity score of 9.2 out of 10.
Under certain conditions, these weaknesses can be exploited remotely without the need for login credentials. An attacker could potentially execute malicious code on affected servers, effectively taking control of websites. The AI-assisted researchers also demonstrated that the flaws could expose sensitive data stored in server memory, such as passwords, authentication tokens, and API keys. A particularly concerning aspect is that these vulnerabilities exist in PHP’s core engine. This means websites can be compromised even if their specific application code is perfectly secure.
OpenAI emphasizes that human developers and security teams had examined the underlying code for years without fully resolving the issues. In contrast, researchers using AI tools demonstrated practical exploitation methods within just two weeks. This rapid turnaround underscores the potential efficiency of AI in cybersecurity auditing. However, some might argue that if the flaws were only exploitable with AI, they might have been effectively harmless to traditional attackers. OpenAI challenges this view with its “Defender's Window” concept.
The Defender's Window describes a narrow timeframe during which organizations can use advanced AI models to find and patch vulnerabilities before malicious threat actors gain access to similar capabilities. OpenAI argues that powerful technology will inevitably be used by bad actors, making it a collective responsibility to act proactively. This perspective was recently echoed by Anthropic, whose Claude Mythos model identified thousands of zero-day vulnerabilities in major operating systems and web browsers. As AI continues to evolve, the balance between finding and fixing bugs will likely become a central theme in digital security.
The incident serves as a reminder of the dynamic nature of web security. While the patches are now available, the underlying lesson is that traditional security audits may no longer be sufficient. The speed at which AI can identify complex, deep-seated bugs suggests that a new era of automated vulnerability discovery is here. For website administrators, the immediate next step is clear: check their PHP versions and upgrade to the latest patched releases to ensure their sites are protected against these critical flaws.
