OpenAI's AI Model Locates Severe Flaws in PHP Web Engine

Critical security flaws in a programming language used by a vast number of websites have been patched after an AI-assisted audit.

On Oct. 21, OpenAI announced that researchers using its GPT-5.6 Sol model discovered two severe vulnerabilities in PHP, an open-source language that runs an estimated 70% of the internet. The discovery was made under OpenAI's "Patch the Planet" cybersecurity program, which coordinates with security firms and government agencies to address such issues. OpenAI stated the two-month timeline for patching the flaws was due to the complexity of the required changes to the PHP engine.

The PHP Foundation has released patched versions (8.2.35, 8.3.36, 8.4.27, and 8.5.12) to address the vulnerabilities. The coordinated release was moved up from its scheduled date of Oct. 22 to Oct. 21 after premature disclosures on Oct. 20 led to public outcry. Officials are urging all sites using PHP to upgrade to a patched version immediately.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are related to how PHP handles memory and errors. Both have been assigned a critical severity score of 9.2 out of 10. Because the flaws are in PHP's core engine, websites can be affected even if their own application code has no security flaws. Under certain conditions, attackers can exploit these weaknesses remotely, without needing login credentials, to execute malicious code on affected servers, potentially taking control of websites. The AI-assisted researchers also demonstrated that the flaws could expose sensitive information stored in server memory, including passwords, authentication tokens, and API keys.

The PHP Foundation had known about an underlying flaw since 2024 but was unable to identify an exploitation method or a fix. In contrast, AI-assisted researchers working with OpenAI's tools identified an exploitable vulnerability within two weeks. OpenAI argues that this incident demonstrates its "Defender's Window" concept, which describes a limited timeframe for organizations to use advanced AI models to strengthen their defenses before those same capabilities become widely available to malicious actors. OpenAI's announcement follows a recent report from Anthropic's Claude Mythos, which identified 'thousands of zero-day vulnerabilities' in 'every major operating system and every major web browser.'

The vulnerabilities have been patched, and users are advised to update their software. The broader question of how AI will be used to both find and exploit such flaws in the future remains a central concern for security researchers.