OpenAI Solves Two-Year PHP Puzzle to Patch Critical Web Flaws

OpenAI has revealed that its GPT-5.6 Sol model played a central role in identifying critical security holes in PHP, the open-source language that powers an estimated 70% of the web. The company announced the discovery on October 21, stating that researchers under its Patch the Planet cybersecurity initiative used the AI to uncover vulnerabilities that had eluded human developers for two years. Following the identification of these flaws, OpenAI coordinated a broad coalition of PHP maintainers, security providers, and government agencies to develop fixes over a two-month period.

The primary claim from OpenAI is that the AI system successfully transformed a known but unexploitable bug into a practical attack vector within just two weeks. This finding highlights a significant shift in cybersecurity dynamics, where automated tools can rapidly validate theoretical risks. The company describes this incident as one of the most significant cybersecurity discoveries of 2026, given the widespread reliance on PHP across the global internet infrastructure. The speed at which the AI identified the exploit path stands in stark contrast to the previous two-year period where human teams could not determine how the flaw could be leveraged.

However, the timeline of the fix was compressed due to external pressures. The PHP Foundation originally scheduled the release of patched versions for October 22. But premature disclosures on October 20 sparked public outcry, prompting the foundation to bring the release forward to October 21. The final updates include PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Notably, older versions such as PHP 8.1 and below will not receive official fixes, leaving those installations potentially vulnerable unless users upgrade to the newer branches.

The investigation began on July 30, 2026, when researchers from Calif, a California-based cybersecurity firm and founding partner of the Patch the Planet program, started auditing PHP at the request of the PHP Foundation. The foundation had been aware of the underlying defect since 2024 but lacked the method to exploit it or the solution to patch it effectively. On August 11, Calif researcher Ryan A. identified the exploitable vulnerability, and OpenAI researchers confirmed it the same day. Shortly after, another firm, Wiz, independently identified an additional related flaw, expanding the scope of the security risk.

The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, stem from errors in how PHP manages computer memory and handles fatal errors. The first issue arises when the engine runs out of allocated memory during a request, potentially leaving incomplete internal data that is later misinterpreted as valid. The second involves a state where a fatal error causes PHP to point to memory that has already been freed. This allows subsequent requests to access or corrupt that memory, creating a dangerous environment for potential attacks.

These flaws are particularly concerning because they reside in the core engine of PHP. This means that websites can be compromised even if their specific application code is secure. Attackers can exploit these weaknesses remotely without needing login credentials, allowing them to execute malicious code on affected servers. The AI-assisted researchers also demonstrated that these bugs could expose sensitive data stored in server memory, including passwords, authentication tokens, and API keys. Both vulnerabilities have been assigned a critical severity score of 9.2 out of 10.

OpenAI is using this incident to illustrate what it calls the Defender's Window. This concept, introduced after previous AI models hacked Hugging Face, suggests there is a narrow timeframe during which organizations can use advanced AI to find and patch defenses before those same capabilities become widely available to malicious actors. The company argues that powerful technology will inevitably be used by bad actors, making proactive defense a collective responsibility. This stance challenges the view that flaws which require AI to exploit are effectively harmless.

The situation raises open questions about the future balance between AI-assisted defense and attack. While human teams struggled for two years to resolve these specific memory management issues, AI tools found the path to exploitation quickly. OpenAI points to recent findings by Anthropic's Claude Mythos, which identified thousands of zero-day vulnerabilities in major operating systems and browsers, to support its argument for urgent action. For now, every site using PHP is advised to upgrade to the latest patched versions to maintain security.

The rapid resolution of these bugs marks a turning point in how the industry views legacy code. The fact that a two-year-old bug became a critical threat so quickly underscores the changing landscape of web security. As AI models continue to advance, the window for defenders to act may become even shorter, requiring constant vigilance from developers and system administrators across the Mid-Atlantic and beyond.