PHP Flaws Threaten Majority of Web Sites After AI Discovery

A pair of critical security flaws in PHP could allow attackers to take control of a vast portion of the web. The programming language runs an estimated 70 percent of websites worldwide. OpenAI announced on October 21 that its AI model helped uncover these serious vulnerabilities. The discovery triggered a coordinated response from multiple industry groups to issue fixes.

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Both involve errors in how PHP manages computer memory and handles errors. In the first case, the system may run out of allocated memory during a request. This can leave incomplete internal data behind. The engine might later mistake this leftover data for valid information. The second issue occurs when a fatal error happens. PHP may end up pointing to memory that has already been freed. Subsequent requests can then access or corrupt that memory.

Attackers can exploit these weaknesses remotely without needing login credentials. This could allow them to execute malicious code on affected servers. They might also expose sensitive information stored in server memory. This includes passwords, authentication tokens, and API keys. Both vulnerabilities received a critical severity score of 9.2 out of 10. The bugs exist in the core engine, so even secure application code can leave a site vulnerable.

The PHP Foundation has released patched versions to address the issues. Users should upgrade to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12. Versions 8.1 and older will not receive official fixes. The coordinated release was originally scheduled for October 22. However, premature disclosures on October 20 led to public outcry. As a result, the release was brought forward to October 21.

Researchers from Calif, a cybersecurity firm, began auditing PHP on July 30, 2026. This work was part of OpenAI's Patch the Planet initiative. The PHP Foundation had known about the underlying flaw since 2024. Human developers could not find a way to exploit it or a fix. On August 11, a Calif researcher identified the exploitable vulnerability. OpenAI researchers found it the same day. A separate firm named Wiz independently identified an additional vulnerability later.

OpenAI highlights this incident as an example of its Defender's Window concept. This idea describes a narrow timeframe for using advanced AI to strengthen defenses. It suggests organizations can patch flaws before malicious actors gain access to similar AI tools. The company argues that powerful technology will inevitably be used by bad actors. Therefore, it is a collective responsibility to act proactively. Anthropic's Claude Mythos recently identified thousands of zero-day vulnerabilities in major operating systems and browsers.

The timeline shows a stark contrast between human and AI capabilities. Human security teams examined the code but could not resolve the flaws for two years. AI-wielding researchers demonstrated practical exploitation methods within two weeks. OpenAI considers this one of the biggest cybersecurity discoveries of 2026. The company attributes the two-month fix timeline to the complexity of the task. Major changes to the PHP engine were required to secure the system.

The next step for website owners is to upgrade their PHP versions. OpenAI says every site using PHP can now safely upgrade to stay secure. Administrators should verify their current version and apply the appropriate patch. This action helps protect servers from potential remote attacks. The incident underscores the growing role of AI in finding deep-seated software bugs.