70 Percent of the Web: AI Finds Critical PHP Flaws Humans Missed

Two critical vulnerabilities in PHP, the open-source language that supports an estimated 70% of websites, have been exposed after AI-assisted researchers turned a long-standing bug into working exploits. The discovery highlights a growing trend where artificial intelligence identifies security gaps that have evaded human developers for years. OpenAI announced the findings on Oct. 21, stating that its GPT-5.6 Sol model helped uncover the flaws under its Patch the Planet cybersecurity initiative.

The timeline of events reveals a significant lag between discovery and resolution. The PHP Foundation had been aware of the underlying code flaw since 2024, but teams could not determine how to exploit it or how to fix it. On July 30, 2026, researchers from Calif, a California-based firm and founding partner of the initiative, began auditing PHP with OpenAI tools at the Foundation's request. By Aug. 11, Calif researcher Ryan A. identified an exploitable vulnerability, a finding matched by OpenAI researchers the same day. The firm Wiz independently identified a second related issue shortly thereafter.

The two bugs, tracked as CVE-2026-109618 and CVE-2026-109619, involve fundamental errors in how PHP manages memory and handles errors. The first flaw occurs when the engine runs out of allocated memory during a request, potentially leaving incomplete data that the system later treats as valid. The second involves a fatal error leaving the engine pointing to memory that has already been freed. These weaknesses allow attackers to remotely execute malicious code without login credentials, potentially taking control of affected servers. Both issues received a critical severity score of 9.2 out of 10.

OpenAI noted that human teams examined the code but failed to fully resolve the issues, allowing them to persist for two years. In contrast, the AI-assisted team demonstrated practical exploitation methods within two weeks. The company argues that the flaws might have remained harmless without AI, but it maintains that proactive defense is necessary as these tools become widely available to threat actors. This approach is part of what OpenAI calls the Defender's Window, a narrow timeframe for organizations to strengthen defenses before AI-driven attacks become common.

The PHP Foundation released patched versions, including 8.2.35, 8.3.36, 8.4.27, and 8.5.12, to address the vulnerabilities. Versions 8.1 and older will not receive official fixes. The coordinated release was originally planned for Oct. 22 but was moved up to Oct. 21 following premature disclosures on Oct. 20 that sparked public concern. The company attributed the two-month fix timeline to the complexity of the task, which required significant changes to the PHP engine.

The incident is being viewed as one of the major cybersecurity discoveries of 2026 due to the ubiquity of PHP. The vulnerabilities exist in the core engine, meaning sites are affected even if their specific application code is secure. Researchers also demonstrated that the flaws could expose sensitive data stored in server memory, such as passwords, authentication tokens, and API keys. OpenAI states that all sites using PHP can now safely upgrade to remain secure.

The broader implications extend beyond this specific case. Anthropic recently reported that its Claude Mythos model identified thousands of zero-day vulnerabilities in major operating systems and browsers. OpenAI uses these examples to argue that powerful technology will inevitably be used by bad actors. Therefore, it positions the proactive use of AI for defense as a collective responsibility for the tech industry.