Critical Flaws Affect 70 Percent of Web

An estimated 70 percent of the internet runs on PHP, a ubiquitous open-source programming language recently found to contain two critical vulnerabilities that could allow remote attackers to seize control of servers. OpenAI announced on October 21 that these severe flaws, which had persisted for two years, were identified and turned into working exploits in just two weeks by researchers using the company’s GPT-5.6 Sol model.

The discovery occurred under the "Patch the Planet" cybersecurity initiative, a program in which Calif, a California-based cybersecurity firm and founding partner, began auditing PHP code on July 30, 2026. Although the PHP Foundation had been aware of the underlying issue since 2024, human developers were unable to determine a method for exploitation or a reliable fix. On August 11, Calif researcher Ryan A. identified the exploitable nature of the bug, with OpenAI researchers confirming the finding the same day. A separate firm, Wiz, independently detected an additional related vulnerability during the same period.

The two issues, designated CVE-2026-109618 and CVE-2026-109619, stem from errors in how the PHP engine manages memory and processes fatal errors. In the first case, if the system runs out of allocated memory during a request, it may retain incomplete internal data that is later misinterpreted as valid. The second flaw occurs when a fatal error causes the engine to point to memory that has already been released, allowing subsequent requests to access or corrupt that space. Both vulnerabilities carry a critical severity score of 9.2 out of 10.

Because these defects reside in the core engine rather than in specific application code, websites remain vulnerable even if their own software is secure. Researchers demonstrated that attackers could exploit these weaknesses remotely without login credentials to execute malicious code. Furthermore, the flaws could expose sensitive data stored in server memory, such as passwords, authentication tokens, and API keys. OpenAI considers this one of the most significant cybersecurity discoveries of 2026 due to the language's widespread use.

To address the threat, a coalition of PHP maintainers, security providers, and government agencies coordinated a two-month effort to develop fixes. This timeline was extended by the complexity of the required changes to the PHP engine. The PHP Foundation released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 on October 21, moving the release forward from its original October 22 date due to premature disclosures on October 20. Sites using PHP 8.1 or older versions will not receive official fixes.

OpenAI frames this incident as evidence of the "Defender's Window," a concept suggesting that organizations must use advanced AI to find and patch vulnerabilities before those same tools become widely available to malicious actors. The company argues that while the flaws might have remained theoretical without AI, the technology necessitates proactive defense. This view aligns with recent findings by Anthropic, which reported that its model identified thousands of zero-day vulnerabilities in major operating systems and browsers.

The company states that all PHP users can now safely upgrade to the latest versions to secure their infrastructure. By leveraging AI to resolve a bug that stumped human experts for two years, the initiative highlights the shifting dynamics of modern cybersecurity, where rapid identification and remediation are driven by advanced computational analysis.