AI Tools Turn Stalled PHP Bug into Exploitable Threat Affecting Majority of Web
OpenAI’s latest model helped researchers convert a long-standing code flaw into critical vulnerabilities, prompting emergency patches for the programming language that powers most of the internet.
By Rebecca Dawson ·
Approximately 70% of the internet’s websites run on PHP, a programming language now targeted by critical security flaws that could allow attackers to take control of servers. OpenAI announced on Wednesday that researchers working under its "Patch the Planet" cybersecurity initiative used its GPT-5.6 Sol model to uncover these vulnerabilities. The discovery highlights a shift in cyber defense, where advanced AI models are being used to identify weaknesses that have eluded human developers for years.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, stem from errors in how PHP manages memory and handles fatal errors. One flaw occurs when the engine runs out of allocated memory, potentially leaving incomplete internal data that is later mistaken for valid information. The second involves a fatal error causing the system to point to already freed memory, allowing subsequent requests to access or corrupt it. Both issues received a critical severity score of 9.2 out of 10.
These flaws are particularly dangerous because they reside in PHP's core engine, meaning websites can be compromised even if their application code is secure. Attackers can exploit these weaknesses remotely without login credentials to execute malicious code. Furthermore, the vulnerabilities could expose sensitive data stored in server memory, including passwords, authentication tokens, and API keys.
The PHP Foundation had been aware of the underlying code flaw since 2024 but could not determine a method to exploit it or a fix. In July, the Foundation requested that Calif, a California-based cybersecurity firm and founding partner of the Patch the Planet program, begin auditing PHP using OpenAI tools. On August 11, Calif researcher Ryan A. identified the exploitable vulnerability, followed immediately by OpenAI researchers. The cybersecurity firm Wiz independently identified the additional vulnerability shortly thereafter.
Following the discovery, OpenAI coordinated a coalition of PHP maintainers, security providers, and government agencies to develop fixes over two months. The company attributed the timeline to the complexity of the task, which required significant changes to the PHP engine. Patched versions, including PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, were released on Wednesday. The release was moved up from its original schedule of Thursday after premature disclosures on Tuesday sparked public concern. Versions 8.1 and older will not receive official fixes.
OpenAI describes this incident as an example of the "Defender's Window," a concept it introduced following its models' interaction with Hugging Face. The company argues there is a narrow timeframe during which organizations can use frontier AI to patch defenses before those same capabilities become widely available to malicious actors. While some argue the flaws were harmless without AI-driven exploitation, OpenAI maintains it is a collective responsibility to proactively address potential vulnerabilities as powerful technology inevitably finds its way into the hands of bad actors.
The company considers this one of the most significant cybersecurity discoveries of 2026 due to the ubiquity of PHP. Human teams had examined the code for two years without fully resolving the issues, whereas AI-assisted researchers demonstrated practical exploitation methods within two weeks of the audit beginning.
Source: Tom's Hardware
