AI Tools Expose Deep PHP Flaws Affecting 70% of the Web
Advanced AI models identified critical memory errors in the core of PHP, leading to emergency patches for a vast portion of the internet.
By Rahul Mehta ·
Seventy percent of the world’s websites rely on a programming language that has just suffered a significant security shakeup. OpenAI revealed on October 21 that its GPT-5.6 Sol model, part of the 'Patch the Planet' initiative, detected critical vulnerabilities in PHP. These flaws exist in the language's core engine, meaning they affect the underlying infrastructure of millions of sites regardless of how well-coded the individual applications are.
The discovery highlights a growing trend in cybersecurity where artificial intelligence outpaces human developers in finding deep-seated bugs. Researchers from Calif, a founding partner in the initiative, began auditing PHP on July 30, 2026, at the request of the PHP Foundation. While the Foundation had been aware of the underlying issue since 2024, human teams could not determine how to exploit or fix it. It took AI-assisted researchers just two weeks to turn that two-year-old mystery into working exploits.
Two specific vulnerabilities, designated CVE-2026-109618 and CVE-2026-109619, were identified with critical severity scores of 9.2 out of 10. The first flaw occurs when PHP runs out of memory during a request, potentially leaving behind incomplete data that the engine later misinterprets as valid. The second involves a fatal error that causes the system to point to memory that has already been freed. Attackers can leverage these issues remotely without login credentials to execute malicious code or extract sensitive data like passwords and API keys from server memory.
In response, the PHP Foundation released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Sites running PHP 8.1 or older will not receive official fixes. The coordinated release was moved up from October 22 to October 21 due to premature disclosures on October 20 that sparked public concern. OpenAI notes that this incident exemplifies its 'Defender's Window' concept, a narrow timeframe where organizations can use frontier AI to strengthen defenses before those same tools become widely available to attackers.
The company argues that while some may view the flaws as harmless without AI, the inevitable adoption of these tools by bad actors makes proactive patching a collective responsibility. This perspective follows recent reports that Anthropic’s Claude Mythos model identified thousands of zero-day vulnerabilities in major operating systems and browsers. The incident underscores the shifting landscape of web security, where the ubiquity of PHP makes it a prime target for AI-driven discovery.
Website administrators are advised to upgrade their PHP versions immediately to ensure safety. As AI models continue to evolve, the gap between vulnerability discovery and public exploitation may shrink further, placing increased pressure on legacy systems to adapt or risk becoming obsolete in the face of automated threats.
Source: Tom's Hardware
