AI Assistance: Critical PHP Vulnerabilities Fixed

Major security flaws in the PHP programming language, which underpins a significant portion of the web, were resolved on October 21 following a coordinated repair effort that began after an artificial intelligence model assisted in finding them.

OpenAI announced the discovery in a press release, stating that researchers operating under its Patch the Planet cybersecurity initiative utilized its GPT-5.6 Sol model to uncover these critical vulnerabilities. Following the identification of the flaws, the company coordinated a coalition involving researchers, PHP maintainers, security providers, and government cybersecurity agencies to remediate the issues over a two-month period. The extended timeline was attributed to the task's complexity, as fixing the vulnerabilities required major changes to the PHP engine.

The PHP Foundation has released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address these vulnerabilities. Older versions, specifically PHP 8.1 and prior, will not receive official fixes. Although the coordinated release was originally scheduled for October 22, it was advanced to October 21 following premature disclosures on October 20, which resulted in public outcry.

The flaws, identified as CVE-2026-109618 and CVE-2026-109619, relate to how PHP manages computer memory and handles errors. One vulnerability occurs when PHP runs out of allocated memory during a request, potentially leaving incomplete internal data that the engine may later treat as valid. The second involves a scenario where a fatal error leaves PHP pointing to memory that has already been freed, allowing subsequent requests to access or corrupt it. Under specific conditions, attackers can exploit these weaknesses remotely without needing login credentials to execute malicious code on affected servers, potentially taking control of websites. Both vulnerabilities received a critical severity score of 9.2 out of 10.

Operating as part of the Patch the Planet program, researchers from Calif, a California-based cybersecurity firm and the program's founding partner, began auditing PHP with OpenAI tools on July 30, 2026, at the request of the PHP Foundation. The Foundation had known about the underlying flaw since 2024 but was unable to identify an exploitation method or a fix. Calif researcher Ryan A. first identified the exploitable vulnerability on August 11, followed by OpenAI researchers that same day. Subsequently, another cybersecurity firm, Wiz, independently identified an additional vulnerability.

Using AI, the researchers also demonstrated that the flaws could expose sensitive information stored in server memory, including passwords, authentication tokens, and API keys. Most concerning, the vulnerabilities exist in PHP's core engine, meaning websites can be affected even if their application code has no security flaws. OpenAI says every site using PHP can now safely upgrade its version to stay secure.

Human developers and security teams examined the underlying code but could not fully resolve the flaws, allowing them to persist for two years after discovery. In contrast, AI-wielding researchers demonstrated practical ways to exploit it within two weeks. OpenAI highlights the incident, which it considers one of the biggest cybersecurity discoveries of 2026 given PHP's ubiquity, as an example of the Defender's Window concept in action. This concept describes a critical, narrow timeframe during which organizations can use advanced frontier AI models to find, patch, and strengthen their cybersecurity defenses before those same AI-driven attack capabilities become widely available to malicious threat actors.