PHP Security: AI Tools Expose Critical Flaws Affecting Most of the Web

The internet runs largely on PHP, a programming language estimated to support 70% of all websites. On Oct. 21, OpenAI announced that its AI model, GPT-5.6 Sol, helped uncover critical security vulnerabilities in this foundational software.

The discovery highlights a significant shift in how cybersecurity threats are identified. Researchers working under OpenAI’s Patch the Planet initiative used the AI to analyze code that had puzzled human developers for years. The process turned a known but dormant flaw into a practical attack method in just two weeks.

Two specific vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were identified. Both score 9.2 out of 10 for severity, marking them as critical. These flaws exist within the core PHP engine, meaning websites can be compromised even if their own application code is secure.

The first issue arises when PHP runs out of allocated memory during a request. This can leave incomplete internal data that the engine later mistakes for valid information. The second problem occurs when a fatal error causes PHP to point to memory that has already been freed. This allows subsequent requests to access or corrupt that memory space.

Attackers can exploit these weaknesses remotely without needing login credentials. Successful exploitation could allow them to execute malicious code on affected servers. The AI tools also demonstrated that these flaws could expose sensitive data in server memory, including passwords, authentication tokens, and API keys.

The PHP Foundation released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to fix these issues. Users of PHP 8.1 and older versions will not receive official fixes. The coordinated release was originally planned for Oct. 22 but moved up to Oct. 21 after premature disclosures on Oct. 20 caused public concern.

The underlying flaw had been known to the Foundation since 2024, but no one could find a way to exploit it or a proper fix. Calif, a California-based cybersecurity firm, began auditing PHP with OpenAI tools on July 30 at the Foundation’s request. Calif researcher Ryan A. identified the exploitable vulnerability on Aug. 11, with OpenAI researchers confirming it the same day. Another firm, Wiz, independently found the second vulnerability.

OpenAI describes this incident as an example of the Defender's Window concept. This idea suggests there is a narrow timeframe where organizations can use advanced AI to find and patch flaws before bad actors gain access to similar capabilities. The company argues that proactive defense is necessary because powerful technology will inevitably be used by attackers.

The fix required major changes to the PHP engine, which took a coalition of researchers, maintainers, and government agencies two months to complete. OpenAI attributes this timeline to the complexity of the task. The company views this as one of the major cybersecurity events of 2026, given the widespread use of PHP.