PHP Security Overhaul: AI Models Expose Deep-Rooted Web Vulnerabilities
A coalition led by OpenAI has resolved critical memory flaws in PHP, a task that eluded human developers for two years but was solved in just two weeks by AI assistance.
By Kavya Kapoor ·
The PHP Foundation released updated software versions on October 21, 2026, following a scramble to address critical security gaps discovered by AI-assisted researchers. The patch was accelerated from its original October 22 schedule after early disclosures on October 20 sparked public concern. These updates, designated as versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, are now available for immediate deployment. Users of PHP 8.1 and older releases will not receive official fixes for these specific issues, meaning they must upgrade their environments to ensure protection.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, stem from errors in how the PHP engine manages computer memory and processes fatal errors. The first flaw occurs when the system runs out of allocated memory, potentially leaving incomplete internal data that the engine later treats as valid. The second issue involves a state where a fatal error leaves the system pointing to memory that has already been freed. This allows subsequent requests to access or corrupt that memory, creating a pathway for remote attackers to execute malicious code without needing login credentials.
OpenAI announced the discovery on October 21, attributing the findings to its GPT-5.6 Sol model under the Patch the Planet cybersecurity initiative. The project began in July 2026 when researchers from Calif, a California-based firm and the program's founding partner, started auditing PHP at the Foundation's request. The underlying flaw had been known since 2024, but human developers could not identify an exploitation method or a fix. On August 11, 2026, Calif researcher Ryan A. identified the exploitable vulnerability, and OpenAI researchers confirmed it the same day. Another firm, Wiz, independently found a related flaw during the same period.
Both vulnerabilities carry a critical severity score of 9.2 out of 10. Because the flaws exist in the core engine of PHP, they affect a vast portion of the internet, estimated at 70% of websites. The AI tools demonstrated that these weaknesses could expose sensitive data stored in server memory, such as passwords, authentication tokens, and API keys. The speed of the discovery highlights a significant shift in cybersecurity, where AI-driven tools can turn long-standing, theoretical bugs into working exploits in a matter of weeks, a task that had stumped human teams for two years.
OpenAI frames this event as a prime example of its Defender's Window concept. The company argues that there is a narrow timeframe during which organizations can use advanced AI to find and patch defenses before similar capabilities become widely available to malicious actors. This perspective challenges the view that flaws are harmless if they require AI to exploit. OpenAI maintains that it is a collective responsibility to act proactively, noting that other models, such as Anthropic's Claude Mythos, have recently identified thousands of zero-day vulnerabilities in major operating systems and web browsers.
The resolution involved a coordinated effort among PHP maintainers, security providers, and government cybersecurity agencies over a two-month period. OpenAI noted that the timeline was lengthy due to the complexity of the task, which required major changes to the PHP engine. The company stated that all sites using PHP can now safely upgrade their versions. This incident is being viewed as one of the most significant cybersecurity discoveries of 2026, underscoring the growing role of artificial intelligence in both identifying and resolving deep-rooted software defects.
Source: Tom's Hardware
