OpenAI Model Uncovers Major Flaws in PHP

OpenAI announced on Oct. 21 that its GPT-5.6 Sol model was instrumental in uncovering critical security flaws within PHP, the open-source language estimated to run a significant portion of the internet. The discovery was made by researchers under the company's "Patch the Planet" cybersecurity initiative, which led to a coordinated effort to address the issues.

After identifying the vulnerabilities, OpenAI organized a coalition involving researchers, PHP maintainers, security providers, and government agencies to develop and deploy fixes over a two-month period. The company attributed this extended timeline to the task's inherent complexity, which necessitated substantial modifications to the PHP engine.

The PHP Foundation has since released patched versions, including PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, to resolve the identified issues. However, older versions like PHP 8.1 will not receive official updates. The coordinated release, originally scheduled for Oct. 22, was moved to Oct. 21 following premature disclosures on Oct. 20 that prompted public outcry.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, concern how PHP manages computer memory and handles errors. Under certain conditions, these flaws could allow remote attackers, without needing login credentials, to execute malicious code on servers, potentially gaining control of websites. The vulnerabilities exist in PHP's core engine, meaning websites could be affected even if their application code is secure.

The incident began on July 30, 2026, when researchers from Calif, a California-based firm and founding partner of the Patch the Planet program, started auditing PHP at the PHP Foundation's request. The Foundation had been aware of an underlying flaw since 2024 but had been unable to identify a method for exploiting it or a way to fix it.

The timeline for a resolution was drastically shortened once AI tools were brought into the process. Calif researcher Ryan A. identified an exploitable vulnerability on Aug. 11, 2026, with OpenAI researchers making the same discovery that day. Later, another firm, Wiz, independently found an additional vulnerability.

Human developers and security teams had examined the code but were unable to fully resolve the flaws, which persisted for two years after discovery. In contrast, AI-assisted researchers demonstrated practical methods to exploit the vulnerabilities within two weeks. The vulnerabilities were both assigned a critical severity score of 9.2 out of 10.

OpenAI highlights this discovery as an example of its "Defender's Window" concept, a narrow timeframe during which organizations can use advanced AI to strengthen their defenses before malicious actors can leverage similar capabilities for attacks. This follows a recent statement from Anthropic's Claude Mythos, which identified thousands of zero-day vulnerabilities in major operating systems and web browsers.

OpenAI argues that powerful technology will inevitably be used by malicious actors, making it a collective responsibility to proactively identify and patch any potential exploitable flaws. The company advises all websites using PHP to upgrade their version to remain secure.