OpenAI and Partners Patch Two-Year-Old PHP Flaws Affecting Most of the Web
An AI-assisted initiative resolved critical memory errors in PHP that human developers had struggled to fix for two years, leading to urgent updates for the language powering roughly 70% of the internet.
By Benjamin Bernard ·
OpenAI announced on October 21 that its GPT-5.6 Sol model helped uncover two critical security flaws in PHP, the open-source language that underpins an estimated 70% of websites. These vulnerabilities, which had remained unresolved for two years despite human scrutiny, were identified through the company's 'Patch the Planet' cybersecurity initiative. The discovery triggered a coordinated response involving PHP maintainers, security firms, and government agencies to issue fixes before the flaws could be widely exploited.
The first key point is the specific nature of the bugs, tracked as CVE-2026-109618 and CVE-2026-109619. Both issues stem from how PHP manages memory and handles errors. One flaw occurs when the engine runs out of allocated memory, potentially leaving behind incomplete data that is later treated as valid. The second involves a fatal error that leaves the system pointing to already-freed memory, allowing subsequent requests to corrupt it. Because these errors reside in PHP's core engine, they can affect websites even if the application code itself is secure.
The second key point concerns the severity and exploitability of these weaknesses. Both vulnerabilities carry a critical severity score of 9.2 out of 10. Researchers demonstrated that attackers could exploit these issues remotely without needing login credentials to execute malicious code and potentially take control of servers. Additionally, the flaws could expose sensitive data stored in server memory, such as passwords, authentication tokens, and API keys. This level of access makes the bugs particularly dangerous for organizations relying on PHP for critical infrastructure.
The third key point involves the timeline and the role of AI in resolving the issue. The PHP Foundation had known about the underlying flaw since 2024 but could not identify a way to exploit or fix it. In July 2026, researchers from Calif, a founding partner in the Patch the Planet program, began auditing PHP using OpenAI tools at the Foundation's request. On August 11, 2026, Calif researcher Ryan A. identified the exploitable vulnerability, with OpenAI researchers confirming it the same day. Another firm, Wiz, independently found a related vulnerability. It took two months to coordinate the patch due to the complexity of the required engine changes.
The PHP Foundation released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address these issues. Older versions, including PHP 8.1 and below, will not receive official fixes, meaning users must upgrade to stay secure. The coordinated release was originally scheduled for October 22 but was moved up to October 21 after premature disclosures on October 20 caused public concern. OpenAI states that every site using PHP can now safely upgrade to its latest version to mitigate the risk.
OpenAI frames this incident as a demonstration of its 'Defender's Window' concept, a narrow timeframe where organizations can use advanced AI to strengthen defenses before attackers do so. The company argues that while the flaws might not have been exploitable without AI, proactive action is a collective responsibility. This perspective contrasts with the view that AI merely revealed existing human errors. The incident is considered one of the significant cybersecurity discoveries of 2026, highlighting the growing role of AI in both finding and fixing software vulnerabilities at scale.
Source: Tom's Hardware · original report published
