OpenAI Credits AI Model for Exposing Deep-Seated PHP Security Flaws

Websites that rely on the PHP programming language must now update their software versions to protect against a pair of critical security defects that could allow remote attackers to seize control of servers. Because PHP powers an estimated 70% of the internet, the discovery carries significant implications for the security of a vast majority of web properties. The issue affects the core engine of the language, meaning sites are vulnerable even if their specific application code contains no obvious security weaknesses. Users of PHP 8.1 and older versions are particularly at risk, as these releases will not receive official fixes, while those on newer versions can upgrade to the recently released patched builds to mitigate the threat.

The identification of these flaws was the result of a specific sequence of events that began in mid-2026. In July, researchers from Calif, a California-based cybersecurity firm, began auditing PHP using OpenAI tools at the request of the PHP Foundation. The Foundation had been aware of an underlying flaw since 2024 but had been unable to determine how to exploit it or how to fix it. On August 11, a Calif researcher identified the exploitable vulnerability, a finding that OpenAI researchers confirmed the same day. Shortly thereafter, another cybersecurity firm, Wiz, independently discovered a second related vulnerability, expanding the scope of the security risk.

The two defects, designated as CVE-2026-109618 and CVE-2026-109619, stem from errors in how PHP manages computer memory and handles processing errors. One flaw occurs when the system runs out of allocated memory, potentially leaving behind incomplete data that the engine later misinterprets as valid. The second involves a fatal error that causes the system to point to memory that has already been freed, allowing subsequent requests to access or corrupt that space. Both vulnerabilities received a critical severity score of 9.2 out of 10. Under specific conditions, attackers can exploit these weaknesses remotely without login credentials to execute malicious code or expose sensitive data such as passwords and API keys stored in server memory.

Following the discovery, OpenAI coordinated a coalition of researchers, PHP maintainers, security providers, and government cybersecurity agencies to address the issues. The company attributed the two-month resolution timeline to the complexity of the task, which required major changes to the PHP engine. While the coordinated release of patched versions for PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 was originally scheduled for October 22, it was brought forward to October 21 after premature disclosures on October 20 sparked public outcry. OpenAI stated that all sites using PHP can now safely upgrade to remain secure.

OpenAI highlighted this incident as a prime example of its "Defender's Window" concept, a timeframe during which organizations can use advanced AI models to find and patch defenses before those capabilities become widely available to malicious actors. The company noted that human developers had examined the code for two years without success, whereas AI-assisted researchers demonstrated practical exploitation methods within two weeks. OpenAI argues that while the flaws might have remained harmless without AI, the technology’s inevitability creates a collective responsibility to act proactively. This perspective follows recent reports that other AI models have identified thousands of zero-day vulnerabilities in major operating systems and web browsers.

The company views this discovery as one of the most significant cybersecurity events of 2026, given the ubiquity of PHP. By leveraging the GPT-5.6 Sol model, researchers were able to turn a bug that had stumped human developers into working exploits, demonstrating the shifting dynamics of digital security. As the industry moves forward, the incident underscores the growing role of artificial intelligence in both identifying and exploiting complex software vulnerabilities, urging a broader technological community to adapt its defensive strategies accordingly.