AI Tools Expose Deep Flaws in PHP, Threatening the Core of the Web

The infrastructure that holds up the modern internet is built on a single programming language that has quietly powered the web for decades. On Oct. 21, OpenAI revealed that its AI systems had discovered severe security holes in PHP, a foundation that supports an estimated 70% of all websites.

The findings mark a significant moment in cybersecurity, as the vulnerabilities were not found by traditional human auditing but by a model named GPT-5.6 Sol. The company stated that this discovery was part of its Patch the Planet initiative, which aims to use frontier AI to strengthen digital defenses before attackers can do the same.

The timeline of this discovery stretches back further than the recent headlines suggest. The PHP Foundation had actually identified the underlying flaw in 2024, but human developers struggled to find a way to exploit it or to craft a proper fix. The issue sat unresolved for two years, a period during which the code remained vulnerable despite its critical nature.

In late July of this year, researchers from Calif, a cybersecurity firm and founding partner in the program, began auditing the language at the Foundation's request. By Aug. 11, they identified an exploitable vulnerability, a breakthrough that OpenAI researchers confirmed the same day. Shortly after, another firm named Wiz independently found a second related weakness, leading to a coordinated effort to address both issues.

The two flaws, designated as CVE-2026-109618 and CVE-2026-109619, stem from how PHP manages computer memory and processes errors. One occurs when the system runs out of memory, leaving behind incomplete data that the engine might later mistake for valid information. The other involves a fatal error that leaves the system pointing to memory that has already been freed, allowing later requests to access or corrupt that space.

These errors are particularly dangerous because they exist in the core engine of the language. This means that even a website with perfectly secure application code can be compromised if it runs an unpatched version of PHP. Attackers can exploit these weaknesses remotely without needing login credentials, potentially taking full control of a server. The flaws also allow for the exposure of sensitive data stored in server memory, such as passwords and API keys.

In response, the PHP Foundation released patched versions for versions 8.2 through 8.5 on Oct. 21. The release was moved up by one day from its original schedule due to premature disclosures that sparked public concern. Older versions, including 8.1 and earlier, will not receive official fixes, meaning sites using them must upgrade to remain secure. Both vulnerabilities carry a critical severity score of 9.2 out of 10.

OpenAI describes this event as a demonstration of the Defender's Window, a concept where organizations can use advanced AI to find and patch weaknesses before those same tools become widely available to malicious actors. The company argues that since powerful technology will inevitably be used by bad actors, there is a collective responsibility to act proactively. This view stands in contrast to the idea that flaws which require AI to exploit are effectively harmless, a stance OpenAI challenges by highlighting the rapid pace of AI adoption in the security sector.