OpenAI credits AI model for breaking a two year old PHP security code
A new AI model helped researchers turn a dormant PHP flaw into a working exploit, prompting an urgent update for millions of websites across the Southwest and beyond.
By Samir Nasser ·
The PHP Foundation released four new patched versions of its popular programming language on Tuesday, moving the timeline forward by a day due to early leaks. The update addresses two critical vulnerabilities that OpenAI says its GPT 5.6 Sol model helped identify and exploit. This rapid response follows a two month coordination effort involving security firms, government agencies, and maintainers to resolve issues that had puzzled human developers for years.
The affected versions include PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Older releases, specifically version 8.1 and earlier, will not receive official fixes. The original release date was set for Wednesday, October 22, but premature disclosures on October 20 forced the schedule to shift. OpenAI states that all sites using the language can now safely upgrade to secure their infrastructure.
The discovery began in July when Calif, a California based cybersecurity firm and founding partner of OpenAI's Patch the Planet initiative, started auditing PHP at the Foundation's request. The underlying flaw had been known since 2024, but no one could find a way to exploit it. On August 11, Calif researcher Ryan A. identified the exploitable weakness, with OpenAI researchers doing the same that day. The firm Wiz independently found a second related vulnerability shortly after.
Both flaws, tracked as CVE 2026 109618 and CVE 2026 109619, score a critical severity of 9.2 out of 10. They stem from errors in how PHP manages memory and handles fatal errors. The first issue leaves incomplete internal data that the engine might mistakenly accept as valid when memory runs out. The second causes the system to point to freed memory, allowing later requests to corrupt or access it. Attackers can exploit these remotely without login credentials to execute malicious code.
The stakes are high because PHP runs an estimated 70 percent of the internet. The vulnerabilities sit in the core engine, meaning websites are at risk even if their own application code is secure. Researchers demonstrated that the flaws could expose sensitive data in server memory, such as passwords, authentication tokens, and API keys. OpenAI calls this one of the largest cybersecurity discoveries of 2026.
OpenAI frames this incident as an example of the Defender's Window. This concept suggests there is a narrow timeframe where organizations can use advanced AI to find and patch defenses before attackers do. The company argues that since powerful technology will inevitably be used by bad actors, it is a collective responsibility to act proactively. This view follows recent reports that Anthropic's Claude Mythos identified thousands of zero day vulnerabilities in major operating systems and browsers.
While human teams failed to fully resolve the code for two years, AI wielding researchers built practical exploits in just two weeks. OpenAI maintains that the flaws were effectively harmless without the AI assistance, yet the company pushes for proactive security measures. The incident highlights a shifting dynamic in digital defense where artificial intelligence is no longer just a tool for building applications, but a primary driver of security discovery.
Source: Tom's Hardware
