AI models find critical flaws in the code powering most of the web
New patches address severe memory errors in PHP, a language used by nearly three-quarters of internet sites.
By Tunde Adeyemi ·
Seventy percent of the internet runs on PHP, a coding language now hit by two critical security flaws that could allow attackers to seize control of major websites. OpenAI announced on October 21 that its GPT-5.6 Sol model helped researchers identify these vulnerabilities, marking a significant milestone in AI-assisted cybersecurity. The discovery has prompted an urgent push to update servers worldwide before the bugs become widely exploited.
The timeline of this revelation stretches back further than expected. The PHP Foundation had been aware of the underlying issue since 2024, but human developers struggled to find a way to exploit or fix it. In July 2026, the Foundation asked Calif, a California-based security firm and founding partner of OpenAI's Patch the Planet initiative, to audit the code using AI tools. On August 11, researchers from Calif and OpenAI identified the exploitable weaknesses. Shortly after, the firm Wiz independently found an additional related flaw.
The vulnerabilities, labeled CVE-2026-109618 and CVE-2026-109619, stem from how PHP manages memory and processes errors. In one scenario, the engine runs out of memory during a request, leaving behind incomplete data that it later mistakes for valid information. In the other, a fatal error causes the system to point to memory that has already been freed, allowing future requests to corrupt it. Both issues carry a critical severity score of 9.2 out of 10 and can be triggered remotely without needing login credentials.
Because these bugs exist in PHP's core engine, they affect websites even if the application code is secure. Researchers demonstrated that the flaws could expose sensitive data stored in server memory, such as passwords, authentication tokens, and API keys. The complexity of the issue required major changes to the PHP engine, which is why the fix took two months to coordinate among researchers, maintainers, and government agencies.
The PHP Foundation has released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to resolve the issues. Versions 8.1 and older will not receive official fixes. The coordinated release was originally planned for October 22, but it was moved up to October 21 after premature disclosures on October 20 sparked public concern. OpenAI stated that all sites can now safely upgrade to these new versions to secure their infrastructure.
OpenAI frames this event as a prime example of its Defender's Window concept. Introduced after its models hacked Hugging Face, the concept describes a narrow timeframe where organizations can use advanced AI to find and patch defenses before those same capabilities become available to malicious actors. The company argues that since powerful technology will inevitably be used by bad actors, it is a collective responsibility to act proactively. It cites recent findings by Anthropic's Claude Mythos, which identified thousands of zero-day vulnerabilities in major operating systems and browsers, as evidence of this trend.
The incident highlights a shift in how security flaws are discovered. Human teams examined the code for two years without fully resolving the issues, while AI-wielding researchers demonstrated practical exploits in just two weeks. While some might argue the flaws were harmless without AI, OpenAI maintains that the ability to find and fix these problems quickly is a crucial advantage. As the web continues to evolve, the speed at which vulnerabilities are detected and patched may become a defining factor in digital security.
For website operators in the Southeast and beyond, the immediate step is to check their PHP version. If you are running version 8.2 or higher, an update is available now. For those on older versions, the lack of an official patch requires careful planning, potentially involving upgrades to newer PHP releases or additional security measures. The swift action by the PHP community serves as a reminder that even the most foundational pieces of the internet are not immune to the rapid changes driven by artificial intelligence.
Source: Tom's Hardware
