AI Cracks PHP Security Shield, Forcing Emergency Patches for 70% of Web

The PHP Foundation released urgent security patches on October 21, pulling forward the scheduled update by a day to address critical vulnerabilities that affect nearly three-quarters of the internet. This rapid response was triggered by premature disclosures on October 20, which sparked public concern before the fixes were officially available. The move ensures that developers can immediately upgrade their systems to protect against newly identified exploits that had remained hidden for years.

OpenAI announced on October 21 that its GPT-5.6 Sol model, operating under the 'Patch the Planet' cybersecurity initiative, played a central role in uncovering these flaws. The company coordinated a coalition of researchers, maintainers, and government agencies to address the issues over a two-month period. OpenAI attributed the duration of the fix to the complexity of the task, which required significant modifications to the core PHP engine rather than simple surface-level adjustments.

The first critical point involves the specific nature of the bugs, tracked as CVE-2026-109618 and CVE-2026-109619. These vulnerabilities stem from how PHP manages computer memory and handles errors. One flaw occurs when PHP runs out of allocated memory during a request, leaving behind incomplete data that the engine later mistakes for valid information. The second issue arises when a fatal error leaves the system pointing to memory that has already been freed, allowing subsequent requests to access or corrupt that space.

The second key development highlights the severity and reach of the threat. Both vulnerabilities carry a critical severity score of 9.2 out of 10, indicating a high risk of compromise. Because these flaws exist in the core PHP engine, websites are vulnerable even if their specific application code is secure. Attackers can exploit these weaknesses remotely without needing login credentials, potentially executing malicious code to take full control of affected servers.

The third major element concerns the data exposure risks revealed by AI-assisted analysis. Researchers demonstrated that the flaws could leak sensitive information stored in server memory, including passwords, authentication tokens, and API keys. This capability underscores the potential for widespread data breaches across the web. The discovery emphasizes that traditional security measures may not be sufficient when underlying infrastructure contains such deep-seated errors.

Contextualizing the discovery, the PHP Foundation had been aware of the underlying flaw since 2024 but could not identify a method to exploit it or a way to fix it. Human developers examined the code for two years without success. In contrast, researchers from Calif, a founding partner of Patch the Planet, began auditing PHP with OpenAI tools on July 30, 2026. Ryan A., a Calif researcher, identified the exploitable vulnerability on August 11, with OpenAI researchers confirming it the same day. Wiz, another cybersecurity firm, independently found the additional vulnerability shortly after.

OpenAI positions this incident as a prime example of its 'Defender’s Window' concept. Introduced after its models hacked Hugging Face, this theory suggests there is a narrow timeframe where organizations can use advanced AI to strengthen defenses before malicious actors gain similar capabilities. The company argues that proactive action is a collective responsibility, citing Anthropic’s Claude Mythos recently identifying thousands of zero-day vulnerabilities in major operating systems and browsers.

Looking ahead, the patched versions PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 are now available for download. Users of PHP 8.1 and older versions must note that they will not receive official fixes, necessitating upgrades to newer versions for security. OpenAI considers this one of the biggest cybersecurity discoveries of 2026, given PHP’s ubiquity. The incident serves as a stark reminder that AI-driven research is rapidly changing the landscape of software security, forcing a faster pace for both discovery and remediation.