AI Researchers Exploit Decade-Old PHP Flaw Affecting 70% of Web

An estimated 70 percent of the entire internet relies on PHP, an open-source programming language that now faces a critical security reckoning after artificial intelligence researchers successfully weaponized a dormant flaw. OpenAI announced on October 21 that its GPT-5.6 Sol model, utilized under the company's "Patch the Planet" cybersecurity initiative, identified severe vulnerabilities in the PHP engine. These defects, which allow remote attackers to execute malicious code without login credentials, have persisted since 2024 but were only recently proven exploitable through AI-assisted analysis.

The timeline of the discovery began when the PHP Foundation, aware of an underlying issue since 2024, requested an audit on July 30, 2026. Researchers from Calif, a California-based firm and founding partner of the initiative, began testing with OpenAI tools shortly thereafter. On August 11, Calif researcher Ryan A. identified the first exploitable vulnerability, a finding immediately matched by OpenAI’s own researchers. The firm Wiz subsequently discovered a second, related flaw. Both issues, tracked as CVE-2026-109618 and CVE-2026-109619, stem from how PHP manages memory and processes errors, specifically when the system runs out of allocated memory or encounters fatal errors that leave pointers to freed memory.

The severity of the situation is underscored by the fact that human developers had examined the code for two years without identifying a practical exploitation method or a fix. In contrast, the AI-wielding team demonstrated working exploits within just two weeks. The vulnerabilities are considered critical because they reside in the core engine, meaning websites can be compromised even if their specific application code is secure. Attackers can remotely access sensitive data stored in server memory, including passwords, authentication tokens, and API keys, potentially seizing control of affected sites.

In response to the findings, a coalition of researchers, PHP maintainers, security providers, and government agencies coordinated a two-month effort to develop fixes. The PHP Foundation released patched versions, 8.2.35, 8.3.36, 8.4.27, and 8.5.12, on October 21. This release was moved forward from its original October 22 schedule following premature disclosures on October 20 that triggered public concern. Users of PHP 8.1 and older versions are advised that no official fixes will be provided for those releases.

OpenAI frames this incident as a prime example of its "Defender's Window" concept, a term introduced after its models previously hacked Hugging Face. The concept describes a narrow timeframe during which organizations can leverage advanced frontier AI to strengthen defenses before the same capabilities become widely available to malicious actors. Both vulnerabilities received a critical severity score of 9.2 out of 10, highlighting the urgency of the patch.

Looking ahead, OpenAI argues that proactive remediation is a collective responsibility, noting that revolutionary technology will inevitably be used by bad actors. The company points to recent findings by Anthropic’s Claude Mythos, which identified thousands of zero-day vulnerabilities in major operating systems and browsers, as evidence that this is a growing trend. For New York and New Jersey businesses, the implication is clear: immediate upgrades to the latest PHP versions are necessary to secure digital infrastructure against AI-driven threats.

The incident challenges the notion that flaws without known exploits are harmless. By demonstrating practical exploitation methods quickly, the AI researchers have shifted the cybersecurity landscape, emphasizing the need for continuous, AI-assisted auditing to keep pace with evolving threats.