PHP Foundation releases urgent patches after AI uncovers critical web flaws
OpenAI’s GPT-5.6 model helped researchers turn a two-year-old coding error into a working exploit, prompting immediate fixes for a language that powers most of the web.
By Aever Bundji ·
Patched versions of PHP are now available to fix two critical security holes that affect roughly 70% of the internet. The PHP Foundation released updates for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 on Tuesday, October 21. This move came one day earlier than scheduled. The schedule shifted due to early disclosures on October 20 that sparked public concern. Sites running PHP 8.1 or older versions will not receive official fixes for these issues.
OpenAI announced the discovery on Monday, October 21. Researchers under its “Patch the Planet” cybersecurity initiative used the GPT-5.6 Sol model to find the vulnerabilities. The flaws have existed since 2024. Human developers knew about the underlying bug but could not find a way to exploit it or fix it for two years. AI-assisted researchers changed that dynamic. They turned the dormant bug into working exploits in just two weeks.
The specific vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both involve errors in how PHP manages computer memory and handles fatal errors. One flaw occurs when the engine runs out of allocated memory. This can leave behind incomplete data that the system later treats as valid. The second flaw leaves PHP pointing to memory that has already been freed. Attackers can use this to access or corrupt data from subsequent requests.
These weaknesses allow remote attackers to execute malicious code without login credentials. They can potentially take control of affected servers. The flaws can also expose sensitive information stored in server memory. This includes passwords, authentication tokens, and API keys. Because the errors exist in the core PHP engine, websites are vulnerable even if their own application code is secure. Both issues received a critical severity score of 9.2 out of 10.
The audit began on July 30, 2026. It was requested by the PHP Foundation. Researchers from Calif, a California-based firm and founding partner of the Patch the Planet program, started the work. They identified the exploitable vulnerability on August 11. OpenAI researchers found it the same day. Another firm, Wiz, independently identified an additional flaw during the process. OpenAI coordinated with maintainers and government agencies to fix the issues over two months. The company cited the complexity of the task as the reason for the timeline.
OpenAI views this incident as a prime example of its “Defender’s Window” concept. This is a narrow timeframe where organizations can use advanced AI to strengthen defenses before attackers do the same. The company argues that powerful technology will inevitably be used by bad actors. Therefore, there is a collective responsibility to act proactively. OpenAI called the discovery one of the biggest cybersecurity events of 2026. It notes that Anthropic’s Claude Mythos recently found thousands of zero-day vulnerabilities in major operating systems and browsers.
Source: Tom's Hardware
