AI Finds PHP Flaws Affecting 70% Web

Seventy percent of the internet runs on PHP, a language now targeted by critical vulnerabilities that OpenAI says its AI model helped uncover. The company announced on Wednesday that researchers utilized its GPT-5.6 Sol model to identify deep-seated security flaws in the PHP engine, which had eluded human developers for nearly two years. This discovery highlights a growing tension between the speed of AI-driven security auditing and the traditional pace of software maintenance.

The two flaws, designated CVE-2026-109618 and CVE-2026-109619, were assigned a critical severity score of 9.2 out of 10. They stem from errors in how PHP manages computer memory and processes fatal errors. Specifically, the first issue arises when the engine exhausts allocated memory during a request, potentially leaving behind incomplete data that the system later misinterprets as valid. The second flaw occurs when a fatal error causes PHP to point to memory that has already been freed, allowing subsequent requests to access or corrupt that space.

These technical shortcomings allow attackers to remotely execute malicious code on affected servers without needing login credentials. The vulnerabilities can also expose sensitive data stored in server memory, including passwords, authentication tokens, and API keys. Crucially, because the flaws reside in the core engine, websites can remain vulnerable even if their specific application code is secure. The PHP Foundation released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the issues, though versions 8.1 and older will not receive official fixes.

The timeline of the discovery is as significant as the technical details. The PHP Foundation had been aware of the underlying flaw since 2024 but could not identify a method to exploit or fix it. Researchers from Calif, a California-based cybersecurity firm and founding partner of OpenAI’s “Patch the Planet” initiative, began auditing PHP with OpenAI tools on July 30. On August 11, Calif researcher Ryan A. identified the exploitable vulnerability, with OpenAI researchers confirming the finding the same day. Wiz, another cybersecurity firm, independently identified the additional vulnerability shortly after.

OpenAI states that a coalition of researchers, maintainers, security providers, and government agencies worked for two months to coordinate the fix. The company attributed this lengthy timeline to the complexity of the task, which required major changes to the PHP engine. The coordinated release was originally scheduled for today but was brought forward to yesterday following premature disclosures that sparked public outcry. OpenAI advises that all PHP sites can now safely upgrade to remain secure.

The incident serves as a central example for OpenAI’s “Defender's Window” concept. Introduced after its models hacked Hugging Face, the theory suggests there is a narrow timeframe during which organizations can use advanced AI to patch defenses before malicious threat actors gain similar capabilities. OpenAI argues that while human teams examined the code for two years without success, AI-wielding researchers demonstrated practical exploits within two weeks. The company contends that powerful technology will inevitably be used by bad actors, making proactive mitigation a collective responsibility.

The stakes are high given the ubiquity of the language. OpenAI labels this one of the largest cybersecurity discoveries of 2026. It points to a similar recent event where Anthropic’s Claude Mythos identified thousands of zero-day vulnerabilities in major operating systems and browsers. While some might argue the flaws were harmless without AI to exploit them, OpenAI maintains that the ability to find them quickly changes the dynamic of digital security.