OpenAI Credits AI Model for Exposing Long-Overlooked PHP Security Flaws

Website owners across the region may find themselves updating server software sooner than planned after a coordinated push to fix critical flaws in PHP, the open-source language that powers an estimated 70% of the internet. The PHP Foundation released updated versions, including 8.2.35, 8.3.36, 8.4.27, and 8.5.12, on October 21, a day earlier than originally scheduled. This accelerated timeline was a direct response to premature disclosures on October 20 that sparked public concern. Sites running PHP 8.1 or older versions will not receive official fixes, leaving those operators to consider upgrades or alternative mitigation strategies.

OpenAI announced on October 21 that researchers under its “Patch the Planet” initiative used its GPT-5.6 Sol model to identify these vulnerabilities. The discovery was made in collaboration with Calif, a California-based cybersecurity firm and the program’s founding partner, which began auditing PHP at the Foundation’s request on July 30, 2026. While the PHP Foundation had been aware of the underlying issue since 2024, human developers had struggled to find a way to exploit or fix it. In contrast, Calif researcher Ryan A. identified an exploitable path on August 11, with OpenAI researchers confirming the finding the same day. Wiz, another security firm, independently found a related flaw.

The two issues, designated CVE-2026-109618 and CVE-2026-109619, stem from how PHP manages memory and handles errors. One flaw occurs when the system runs out of allocated memory, potentially leaving incomplete data that the engine later treats as valid. The other involves a fatal error causing PHP to point to already freed memory, allowing subsequent requests to access or corrupt it. Both vulnerabilities carry a critical severity score of 9.2 out of 10 and can be exploited remotely without login credentials, potentially allowing attackers to execute malicious code or steal sensitive data like passwords and API keys.

OpenAI frames this incident as a prime example of the “Defender’s Window,” a concept the company introduced after its models hacked Hugging Face. This theory suggests there is a narrow timeframe where advanced AI can be used to strengthen defenses before malicious actors gain access to similar capabilities. The company argues that because powerful technology will inevitably be used by bad actors, it is a collective responsibility to address flaws proactively. This stance contrasts with the view that these specific bugs were only dangerous because AI could exploit them, making them effectively harmless otherwise.

The fix required major changes to the PHP engine, leading to a two-month coordination period involving researchers, maintainers, security providers, and government agencies. OpenAI attributes the length of this process to the complexity of the task. Notably, Anthropic’s Claude Mythos recently identified thousands of zero-day vulnerabilities in major operating systems and browsers, reinforcing the broader narrative that AI is accelerating both the discovery and the risk of software flaws.

For ordinary users and business owners, the immediate implication is a need to verify their server versions. While the patches are now available, the incident highlights a shifting landscape where AI-assisted audits are uncovering deep-seated issues that had previously slipped through human review. The speed at which these exploits were developed, within two weeks, stands in stark contrast to the two years the bugs remained dormant, raising questions about the future speed of both offense and defense in cybersecurity.