AI finds two major holes in the code behind most websites

Patched versions of PHP are out now. The PHP Foundation released updates for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 on October 21. This happened a day earlier than planned. The original schedule called for an October 22 release. However, early leaks on October 20 caused public concern. This pushed the team to move up the timeline. Users on PHP 8.1 and older will not get official fixes for these specific issues.

OpenAI announced the details in a press release on October 21. The company says its Patch the Planet initiative found two critical flaws in PHP. This open-source language runs an estimated 70% of the internet. The researchers used the GPT-5.6 Sol model to identify the problems. They then coordinated with a coalition of experts to fix them. This group included PHP maintainers, security providers, and government agencies. The process took two months. OpenAI noted that the complexity of the task required major changes to the PHP engine.

The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both involve how PHP manages memory and handles errors. The first flaw occurs when the system runs out of allocated memory during a request. This can leave incomplete internal data behind. The engine might later mistake this data for valid information. The second flaw is related. It happens when a fatal error leaves the system pointing to memory that has already been freed. Subsequent requests can then access or corrupt this memory. Both issues received a critical severity score of 9.2 out of 10.

Attackers can exploit these weaknesses remotely. They do not need login credentials to do so. This allows them to execute malicious code on affected servers. In some cases, they could take control of websites. The researchers also showed that the flaws could expose sensitive data. This includes passwords, authentication tokens, and API keys stored in server memory. Most concerning is that the bugs exist in the core engine. Websites can be affected even if their own application code is secure.

The discovery process began in late July. Researchers from Calif, a California-based cybersecurity firm, started auditing PHP on July 30, 2026. This was at the request of the PHP Foundation. The Foundation had known about the underlying flaw since 2024. However, they could not find a way to exploit it or fix it. On August 11, a Calif researcher named Ryan A. identified an exploitable vulnerability. OpenAI researchers found the same issue that same day. Another firm, Wiz, independently identified the second vulnerability.

OpenAI frames this event as a prime example of its Defender's Window concept. The company introduced this idea after its models hacked Hugging Face. The concept describes a narrow timeframe. During this window, organizations can use advanced AI to find and patch defenses. This happens before the same AI capabilities become widely available to bad actors. OpenAI argues that powerful technology will inevitably be used by attackers. Therefore, it is a collective responsibility to act proactively. They cite recent findings by Anthropic's Claude Mythos, which identified thousands of zero-day vulnerabilities in major operating systems and browsers.

The timeline highlights a shift in security dynamics. Human developers and security teams examined the code for two years. They could not fully resolve the flaws. The bugs persisted because they were difficult to pin down. In contrast, AI-wielding researchers demonstrated practical exploits within two weeks. This speed has raised questions about the nature of modern vulnerabilities. Some argue that these flaws would never have been exploitable without AI. This would make them effectively harmless in the traditional sense.

OpenAI challenges that view. The company maintains that if the flaw exists, it is a risk. They believe organizations must address potential exploitable issues before attackers find them. The incident is considered one of the biggest cybersecurity discoveries of 2026. This is due to the widespread use of PHP. The coordinated response shows how different groups can work together. It also shows how AI is changing the pace of security research and response.

For now, the recommendation is clear. Sites using PHP should upgrade to the patched versions. This ensures they are protected against the new exploits. The PHP Foundation has confirmed the fixes are ready. The early release was a direct result of the fast-moving nature of the discovery. As AI tools continue to evolve, the gap between finding a bug and fixing it may continue to shrink.

The situation underscores the importance of keeping software up to date. Even core components that have been stable for years can harbor hidden risks. The involvement of multiple firms and agencies shows a collaborative approach. This is becoming more common in the face of complex, AI-discovered threats. The industry is adapting to a new reality where machines play a central role in both finding and fixing security holes.