AI tools find old PHP bugs that affect most of the web

If you manage a website or rely on one that runs on standard server software, the rules for keeping your data safe just changed. On October 21, OpenAI announced that its GPT 5.6 Sol model helped identify critical security holes in PHP. This is the open source programming language that supports an estimated 70 percent of the internet. For many users, this means a potential vulnerability that existed for years has now been turned into a practical threat that requires immediate attention.

The core of the story involves a flaw that human developers had known about since 2024 but could not figure out how to exploit or fix. According to the announcement, researchers from Calif, a cybersecurity firm and founding partner of OpenAI's Patch the Planet initiative, began auditing PHP on July 30 at the request of the PHP Foundation. On August 11, a Calif researcher named Ryan A. identified the exploitable vulnerability. OpenAI researchers found it the same day. Another firm, Wiz, independently discovered a second, related issue.

The two problems are tracked as CVE 2026 109618 and CVE 2026 109619. Both involve how PHP handles memory and errors. The first occurs when the system runs out of memory, potentially leaving behind incomplete data that the engine later treats as valid. The second happens when a fatal error causes the system to point to memory that has already been freed. Under specific conditions, attackers can use these weaknesses to run malicious code remotely without needing login credentials, potentially taking control of affected servers.

OpenAI claims that AI allowed researchers to demonstrate working exploits within two weeks. Human teams, by contrast, had spent two years examining the code without success. This speed is central to the company's argument for what it calls the Defender's Window. This concept suggests there is a narrow timeframe where organizations can use advanced AI to find and patch defenses before malicious actors can do the same.

The discovery forced a quick response from the PHP Foundation. Patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 were released to fix the issues. Sites running PHP 8.1 or older versions will not receive official fixes. The coordinated release was originally planned for October 22, but it was moved up to October 21 after premature disclosures on October 20 caused public concern.

The vulnerabilities are considered critical because they exist in the core engine of PHP. This means a website can be affected even if its own application code is secure. The flaws received a severity score of 9.2 out of 10. Researchers also showed that the bugs could expose sensitive data stored in server memory, such as passwords, authentication tokens, and API keys.

OpenAI attributes the two month timeline for the fix to the complexity of the task, which required major changes to the PHP engine. The company worked with a coalition of researchers, maintainers, security providers, and government agencies. It views this incident as one of the biggest cybersecurity discoveries of 2026 due to how widely PHP is used.

There is, however, a counterargument to the urgency. Some might argue that the flaws would never have been exploitable without AI, making them effectively harmless in the past. OpenAI challenges this view, stating that powerful technology will inevitably be used by bad actors. It argues it is a collective responsibility to act proactively. This stance follows recent reports that Anthropic's Claude Mythos identified thousands of zero day vulnerabilities in major operating systems and web browsers.

For now, the practical step for site owners is clear. OpenAI says every site using PHP can safely upgrade to the newer versions to stay secure. The incident highlights a shifting dynamic in cybersecurity, where AI models are no longer just building features but are actively hunting for weaknesses that human eyes missed for years.