PHP Flaw: AI Finds Two-Year-Old Bug Affecting 70% of Web

Seventy percent of the internet runs on PHP, a fact that just became significantly more relevant to security professionals worldwide. OpenAI announced on Tuesday that its AI model, GPT-5.6 Sol, identified critical security vulnerabilities in the open-source programming language. The discovery highlights a growing trend where artificial intelligence is uncovering deep-seated bugs that have eluded human experts for years. The company described the incident as one of the most significant cybersecurity findings of 2026, given the language’s vast global footprint.

The vulnerabilities were found by researchers operating under OpenAI’s “Patch the Planet” initiative, a program designed to use advanced AI to strengthen digital defenses. The audit began on July 30, 2026, at the request of the PHP Foundation. The foundation had been aware of the underlying flaw since 2024 but had struggled to determine how it could be exploited or how to fix it. Human developers and security teams had reviewed the code for two years without success, leaving the issue unresolved while it sat dormant in the language’s core.

The breakthrough came on August 11, when a researcher from Calif, a California-based cybersecurity firm and founding partner of the initiative, identified an exploitable vulnerability. On that same day, OpenAI’s own researchers confirmed the finding. Shortly after, another security firm, Wiz, independently discovered a second, related flaw. These two issues have been cataloged as CVE-2026-109618 and CVE-2026-109619. Both bugs stem from errors in how PHP manages computer memory and handles fatal errors.

The first vulnerability occurs when PHP runs out of allocated memory while processing a request. This can leave incomplete internal data behind, which the engine may later mistakenly interpret as valid. The second issue involves a fatal error that leaves PHP pointing to memory that has already been freed. This allows subsequent requests to access or corrupt that memory. Both flaws exist in the core engine of PHP, meaning websites can be affected even if their specific application code is secure. Attackers can exploit these weaknesses remotely without needing login credentials, potentially executing malicious code and taking control of affected servers.

Using AI tools, the researchers demonstrated that these flaws could also expose sensitive information stored in server memory. This includes passwords, authentication tokens, and API keys. Both vulnerabilities received a critical severity score of 9.2 out of 10. The speed of the discovery was striking; while the bug had existed for two years, AI-assisted researchers turned it into a working exploit in just two weeks. This rapid development underscores the changing pace of cybersecurity threats and defenses.

In response to the findings, the PHP Foundation released patched versions of the software on Monday, October 21. The updates include PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Users of PHP 8.1 and older versions will not receive official fixes for these specific issues. The coordinated release was originally scheduled for today, October 22, but was moved up by a day following premature disclosures on Sunday, October 20. These early leaks led to public outcry and prompted the foundation to accelerate the rollout of the fixes.

OpenAI attributes the two-month timeline for the fix to the complexity of the task, which required major changes to the PHP engine. The company coordinated a coalition of researchers, PHP maintainers, security providers, and government cybersecurity agencies to ensure the patches were robust. OpenAI emphasized that all sites using PHP can now safely upgrade their versions to remain secure. The company views this event as a prime example of its “Defender’s Window” concept in action.

The Defender’s Window is a concept OpenAI introduced after its models hacked Hugging Face. It describes a narrow timeframe during which organizations can use advanced frontier AI models to find and patch vulnerabilities before those same capabilities become widely available to malicious actors. OpenAI argues that powerful technology will inevitably be used by bad actors, making it a collective responsibility to act proactively. The company points to recent findings by Anthropic’s Claude Mythos, which identified thousands of zero-day vulnerabilities in major operating systems and web browsers, as further evidence of this trend.

This incident marks a shift in how critical software infrastructure is secured. The ability of AI to find and exploit deep code flaws in weeks, rather than years, suggests that traditional security review processes may need to adapt. For the 70% of websites relying on PHP, the immediate action is clear: upgrade to the latest patched versions to close the gap that artificial intelligence has now highlighted.