AI helps fix critical PHP bugs affecting most of the web

Web servers running PHP, a language that powers an estimated 70% of the internet, faced a critical security threat this week. OpenAI announced on October 21 that its AI model, GPT-5.6 Sol, helped researchers uncover severe vulnerabilities in the core of the software. The discovery triggered a coordinated response among developers, security firms, and government agencies to deploy fixes across the global web.

The PHP Foundation released updated versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the issues. Sites running PHP 8.1 or older versions will not receive official patches and must upgrade to newer releases to stay secure. The release date was moved up from October 22 to October 21 after details leaked early on October 20, sparking immediate concern in the developer community.

Two specific flaws, designated CVE-2026-109618 and CVE-2026-109619, stem from errors in how PHP manages computer memory and handles fatal exceptions. The first issue occurs when the engine runs out of memory, leaving incomplete data that it later misidentifies as valid. The second involves a state where the software points to memory that has already been freed, allowing subsequent requests to corrupt that space. Both issues carry a critical severity score of 9.2 out of 10.

Attackers could exploit these weaknesses remotely without needing login credentials. By doing so, they could execute malicious code on affected servers and potentially take full control of websites. Researchers demonstrated that the flaws could also expose sensitive data stored in server memory, such as passwords, authentication tokens, and API keys. Because the bugs reside in the core engine, even applications with perfect code remain vulnerable.

The investigation began on July 30, 2026, when the PHP Foundation asked Calif, a California-based cybersecurity firm and founding partner of the Patch the Planet initiative, to audit the code. The Foundation had been aware of the underlying flaw since 2024 but could not find a way to exploit it or fix it. On August 11, Calif researcher Ryan A. identified an exploitable path, and OpenAI researchers confirmed the vulnerability the same day. A separate firm, Wiz, independently found the second flaw.

OpenAI attributes the two-month timeline for the fix to the complexity of modifying the PHP engine. The company views this event as a prime example of its Defender's Window concept. This theory, introduced after AI models hacked Hugging Face, suggests there is a narrow timeframe where organizations can use frontier AI to secure systems before attackers gain similar capabilities. OpenAI argues that proactive defense is a collective responsibility as these technologies become more powerful.

The incident highlights a shift in how security flaws are found and fixed. Human developers had examined the code for two years without resolving the issues, while AI-assisted researchers turned the known bug into a working exploit in just two weeks. Some argue the flaws were only dangerous because AI could exploit them, but OpenAI maintains that the potential for attack necessitates immediate action. The company points to recent findings by Anthropic's Claude Mythos, which identified thousands of zero-day vulnerabilities in major operating systems and browsers.

For the Southeast and web developers nationwide, the urgency is clear. Any site relying on PHP must update to the latest patched versions as soon as possible. The swift coordination between AI tools and human experts demonstrates that the pace of cybersecurity is accelerating. As AI models become more capable, the window to protect digital infrastructure shrinks, making these proactive measures essential for maintaining stability across the web.