OpenAI Claims AI Found Critical PHP Flaws Affecting Seven In Ten Websites

Seventy percent of the internet runs on PHP. That is the scale of the problem OpenAI detailed in a press release dated October 21. The company announced that its AI model, GPT-5.6 Sol, helped uncover critical security holes in the open-source language. These flaws are now patched, but the speed of the discovery has sparked debate in the cybersecurity world. The incident highlights a new era where artificial intelligence finds weaknesses that humans missed for years.

The story began in July 2026. The PHP Foundation asked a California-based cybersecurity firm called Calif to audit the code. They started this work on July 30. The Foundation already knew about a potential flaw. They had been aware of it since 2024. However, they could not figure out how to exploit it or how to fix it. The bug sat in the code for two years. Human developers looked at it but could not resolve the issue. The flaw remained a mystery.

The breakthrough came on August 11. A researcher at Calif named Ryan A. identified an exploitable vulnerability. OpenAI researchers found the same issue that same day. They used AI tools to demonstrate practical ways to exploit the bug. This work took only two weeks. A separate firm named Wiz also found an additional vulnerability independently. The two issues are tracked as CVE-2026-109618 and CVE-2026-109619. Both involve critical errors in how PHP manages memory and handles errors.

The vulnerabilities are serious. They allow attackers to run malicious code on servers without login credentials. In some cases, the flaws can expose sensitive data like passwords and API keys. The core engine is affected. This means a website can be vulnerable even if its own application code is secure. Both bugs received a critical severity score of 9.2 out of 10. The risk is high because PHP is so common. A successful attack could give bad actors control over popular websites.

The fix process was complex. OpenAI said the task required major changes to the PHP engine. A coalition of researchers, maintainers, and government agencies worked for two months. They aimed to patch the issues safely. The PHP Foundation released fixed versions on October 21. These include PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Older versions like 8.1 will not get official fixes. Users of those versions must upgrade to stay safe.

The release date changed unexpectedly. The coordinated rollout was planned for October 22. However, premature disclosures happened on October 20. This caused public outcry. The team moved the release forward by one day. They wanted to get the patches out before more information leaked. This move underscored the pressure to act quickly in the digital space. Speed is now a key factor in managing security risks.

OpenAI is using this event to promote its Defender's Window concept. The company argues there is a narrow timeframe for action. Organizations can use advanced AI to find and patch flaws. They can do this before bad actors get the same tools. OpenAI introduced this idea after its models hacked Hugging Face. The company believes it is a collective responsibility to act proactively. It challenges the view that AI-driven flaws are harmless. It suggests that powerful technology will inevitably be used by attackers.

Other companies are seeing similar trends. Anthropic recently reported that its model Claude Mythos found thousands of zero-day vulnerabilities. These were found in major operating systems and web browsers. The industry is shifting. AI is now a primary tool for both finding and fixing bugs. For the Southeast and regions across the coast, the impact is local. Many local businesses rely on web platforms built with PHP. Upgrading to the new versions is now a priority for IT teams. The next step is clear. Developers must update their servers to the patched versions to close the gap.