AI Turns Long-Dormant PHP Flaws Into Working Exploits

Two years of human effort failed to solve a critical problem in PHP. In just two weeks, artificial intelligence turned that same problem into a working weapon. On October 21, OpenAI announced that its GPT-5.6 Sol model helped uncover serious security flaws in the programming language. These flaws could put a vast number of websites at risk. PHP runs an estimated 70% of the internet.

The discovery came through OpenAI's "Patch the Planet" cybersecurity initiative. Researchers with the California-based firm Calif began auditing PHP on July 30, 2026, at the request of the PHP Foundation. The foundation had known about the underlying flaw since 2024. But it could not find a way to exploit it. It also could not create a fix. This is where the AI-assisted researchers stepped in. They identified an exploitable path on August 11. Another security firm, Wiz, later found an additional, related vulnerability.

The two flaws, CVE-2026-109618 and CVE-2026-109619, both carry a critical severity score of 9.2 out of 10. They involve errors in how PHP manages memory. When PHP runs out of memory while processing a request, it can leave behind incomplete data. The system might later treat that data as valid. In a related issue, a fatal error can leave PHP pointing to memory that has already been freed. Attackers can use these flaws to run malicious code on affected servers. They can do this remotely and without login credentials. They could potentially take control of websites. The flaws also risk exposing sensitive information from server memory, such as passwords and API keys.

These vulnerabilities exist in PHP's core engine. This means a website can be affected even if its own application code is secure. The PHP Foundation has released patched versions to fix the issues. These include PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP 8.1 and older versions will not receive official fixes. The coordinated release was scheduled for October 22. It was moved up to October 21 after some details leaked on October 20.

OpenAI states that human developers could not fully resolve the flaws for two years. AI-wielding researchers, however, found practical ways to exploit them in two weeks. The company argues it is a collective responsibility to find and fix such problems. It calls this the Defender's Window. This is a narrow timeframe where organizations can use advanced AI to strengthen defenses. They must do this before the same AI capabilities become widely available to bad actors. OpenAI considers this one of the biggest cybersecurity discoveries of 2026.

Other AI models are showing similar power. Anthropic's Claude Mythos recently identified "thousands of zero-day vulnerabilities" in major operating systems and browsers. For now, OpenAI advises every site using PHP to upgrade its version to stay secure.