Web Security: AI Finds Critical PHP Flaws Affecting Most Sites

Critical security flaws in the PHP programming language have been confirmed, affecting an estimated 70% of websites on the internet. These vulnerabilities, which allow attackers to execute malicious code remotely, were identified through an AI-assisted audit. The discovery has triggered an urgent update cycle for web developers worldwide. This marks one of the most significant cybersecurity incidents of the year.

The flaws stem from how PHP manages memory and handles errors. One issue occurs when the engine runs out of allocated memory during a request, leaving behind incomplete data that it later treats as valid. The second issue arises when a fatal error causes PHP to point to memory that has already been freed. Attackers can exploit these weaknesses without login credentials. This allows them to take control of affected servers and potentially steal sensitive data like passwords and API keys.

Researchers from Calif, a cybersecurity firm, began auditing PHP in late July 2026. They were assisted by OpenAI’s GPT-5.6 Sol model. The underlying flaw had been known to the PHP Foundation since 2024, but human developers could not find a way to exploit it or fix it. Using AI tools, researchers turned this dormant bug into a working exploit within two weeks. Another firm, Wiz, independently identified an additional vulnerability during the same period.

The PHP Foundation released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the issues. Versions 8.1 and older will not receive official fixes. The coordinated release was originally scheduled for October 22 but was moved up to October 21. This change was made due to premature disclosures on October 20 that caused public concern. OpenAI stated that every site using PHP should upgrade to stay secure.

OpenAI describes this event as a prime example of its "Defender's Window" concept. This is a narrow timeframe where organizations can use advanced AI to patch defenses before bad actors gain similar capabilities. The company argues that proactive action is a collective responsibility. It notes that other AI models have recently identified thousands of zero-day vulnerabilities in major operating systems and browsers. The company suggests that while AI may be necessary to exploit these flaws, it is also essential for finding them.

The two vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both received a critical severity score of 9.2 out of 10. The fixes required major changes to the PHP engine, which explains the two-month timeline for coordination. The incident highlights the growing role of AI in both discovering and mitigating complex software bugs. It also underscores the need for rapid response when core web technologies are compromised.