PHP Security: AI Models Expose Two-Year-Old Flaws in 70% of the Web

OpenAI has announced that its AI model, GPT-5.6 Sol, played a central role in uncovering critical security weaknesses in PHP, the open-source language that powers an estimated 70% of the internet. The discovery highlights a significant shift in cybersecurity, where artificial intelligence is now capable of identifying and exploiting complex software flaws that had eluded human developers for years. The company revealed these findings on October 21, 2026, as part of its broader 'Patch the Planet' initiative.

The vulnerabilities stem from errors in how PHP manages computer memory and processes errors. Specifically, one flaw occurs when the system runs out of allocated memory during a request, potentially leaving behind incomplete data that the engine later misinterprets as valid. A second related issue arises when a fatal error causes PHP to reference memory that has already been cleared, allowing subsequent requests to access or corrupt that space. Both issues have been assigned a critical severity score of 9.2 out of 10.

Because these bugs reside in the core engine of PHP, they affect websites even if the specific application code is secure. Attackers can exploit these weaknesses remotely without needing login credentials to execute malicious code on servers. Furthermore, the flaws can expose sensitive data stored in server memory, such as passwords, authentication tokens, and API keys. This makes the vulnerability particularly dangerous for a wide range of web services.

The underlying flaw had been known to the PHP Foundation since 2024, but human developers struggled to find a reliable exploitation method or a fix. It was not until July 30, 2026, that researchers from Calif, a cybersecurity firm and founding partner of the Patch the Planet program, began auditing PHP using OpenAI tools at the Foundation's request. On August 11, both Calif researchers and OpenAI teams identified the exploitable nature of the vulnerability. A separate firm, Wiz, independently identified an additional related vulnerability shortly after.

The coordinated release of patched versions, PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, was originally scheduled for October 22 but was moved up to October 21. This change was necessitated by premature disclosures on October 20, which generated public concern. PHP versions 8.1 and older will not receive official fixes, meaning sites running those versions must upgrade to a newer release to remain secure.

OpenAI attributes the two-month timeline for fixing the issues to their complexity, which required significant changes to the PHP engine. The company views this incident as a prime example of the 'Defender's Window' concept. This theory suggests there is a narrow timeframe during which organizations can use advanced AI models to strengthen defenses before malicious actors gain similar capabilities. OpenAI argues that proactive action is a collective responsibility, noting that powerful technology will inevitably be used by bad actors.

The company emphasized that while human teams examined the code for two years without a resolution, AI-assisted researchers developed practical exploits in just two weeks. This speed underscores the changing pace of cybersecurity. OpenAI also cited recent findings by Anthropic, whose model identified thousands of zero-day vulnerabilities in major operating systems and browsers, further supporting the argument for using AI defensively.

For most users and developers, the immediate takeaway is the need to update PHP installations. OpenAI stated that all sites using PHP can safely upgrade to the newly released versions to protect against these critical flaws. The incident serves as a stark reminder of the widespread reliance on PHP and the growing role of artificial intelligence in both discovering and fixing the security gaps that keep the web running.