PHP Foundation Patches Critical AI-Found Flaws Affecting Most of the Web
A two-year-old code defect in PHP was turned into a working exploit by AI-assisted researchers, prompting an urgent security update for a massive portion of the internet.
By Ananya Gupta ·
The PHP Foundation issued emergency security patches on Oct. 21 to address critical vulnerabilities that affect an estimated 70% of the internet. The update resolves two severe flaws in the core memory management of the programming language. These defects allow remote attackers to potentially take control of web servers without needing any login credentials.
OpenAI announced the discovery in a press release dated Oct. 21. The company stated that researchers under its Patch the Planet cybersecurity initiative used its GPT-5.6 Sol model to uncover the issues. The initiative operates in partnership with Calif, a California-based cybersecurity firm. Researchers began auditing PHP with these AI tools on July 30, 2026, at the request of the PHP Foundation.
The underlying flaw had been known to the Foundation since 2024. However, human developers could not identify a method to exploit the bug or find a fix. On Aug. 11, Calif researcher Ryan A. identified the exploitable vulnerability. OpenAI researchers confirmed the finding the same day. Another firm, Wiz, independently identified a second related vulnerability shortly after.
The two issues are tracked as CVE-2026-109618 and CVE-2026-109619. Both involve how PHP handles memory and errors. The first occurs when the engine runs out of allocated memory, leaving incomplete data that may be treated as valid later. The second involves a fatal error that leaves PHP pointing to freed memory. Attackers can use these weaknesses to execute malicious code or access sensitive data like passwords and API keys.
Both vulnerabilities received a critical severity score of 9.2 out of 10. The patches are available for PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Versions 8.1 and older will not receive official fixes. The coordinated release was originally scheduled for Oct. 22, but it was brought forward to Oct. 21 after premature disclosures on Oct. 20 caused public outcry.
OpenAI attributes the two-month timeline for the fix to the complexity of the task. Major changes to the PHP engine were required. The company highlights this incident as an example of its Defender's Window concept. This concept describes a narrow timeframe where organizations can use advanced AI to strengthen defenses before those same tools become widely available to attackers.
The incident raises questions about the role of AI in cybersecurity. AI-wielding researchers demonstrated practical exploits within two weeks of the flaw's identification. In contrast, human teams had examined the code for two years without a solution. Some argue the flaws would have remained harmless without AI, but OpenAI maintains that proactive action is a collective responsibility.
The company notes that powerful technology will inevitably be used by bad actors. It points to recent findings by Anthropic, whose Claude Mythos model identified thousands of zero-day vulnerabilities in major operating systems and browsers. For New England businesses and developers, the urgency is clear. Any site using PHP should upgrade to the latest patched version immediately to stay secure.
The PHP Foundation is coordinating with security providers and government cybersecurity agencies to ensure widespread adoption of the patches. The speed of the response underscores the changing pace of vulnerability discovery. As AI models become more capable, the window for defenders to act is shrinking. Organizations must now integrate these tools into their routine security audits to stay ahead of emerging threats.
Source: Tom's Hardware
