AI models find major security holes in the code behind most of the web

An estimated 70% of the internet runs on PHP, and new findings suggest that a significant portion of that digital infrastructure has been exposed to critical security risks. OpenAI revealed on October 21 that its GPT-5.6 Sol model helped researchers identify two severe vulnerabilities in the language's core engine. These flaws, which have been present since 2024, allow attackers to potentially take control of websites without needing login credentials.

The discovery was made by researchers participating in OpenAI's "Patch the Planet" cybersecurity initiative. Working with the California-based firm Calif, the team began auditing PHP on July 30 at the request of the PHP Foundation. Although the Foundation had been aware of the underlying issue for two years, human developers had been unable to determine how to exploit or fix it. On August 11, the AI-assisted team successfully identified the exploitable nature of the bug, a task that took them just two weeks to demonstrate practically.

The two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, stem from errors in how PHP manages computer memory and handles system crashes. The first occurs when the system runs out of memory, leaving behind incomplete data that may later be mistaken for valid information. The second involves a fatal error that leaves the system pointing to memory that has already been freed, allowing subsequent requests to access or corrupt that space. Both issues carry a critical severity score of 9.2 out of 10.

Because these flaws exist within PHP’s core engine, they can affect websites even if the specific application code is secure. Researchers using AI demonstrated that these weaknesses could expose sensitive data stored in server memory, including passwords, authentication tokens, and API keys. In the most severe scenarios, attackers could remotely execute malicious code on affected servers, effectively gaining control of the site.

In response to the discovery, the PHP Foundation released patched versions of the software on October 21. The updated releases include PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Users running PHP 8.1 or older versions will not receive official fixes for these specific issues. The coordinated release was originally scheduled for October 22 but was moved forward by one day after premature disclosures on October 20 caused public concern.

OpenAI attributes the two-month timeline for the fix to the complexity of the task, which required major changes to the PHP engine. The company coordinated with a coalition of researchers, maintainers, security providers, and government agencies to ensure the patches were robust. The incident is being highlighted by OpenAI as a prime example of its "Defender's Window" concept, a period during which organizations can use advanced AI to strengthen defenses before the same technology becomes widely available to malicious actors.

While some argue that the flaws would have remained harmless without AI assistance, OpenAI maintains that proactive action is a collective responsibility. The company notes that human teams examined the code for years without resolving the issues, whereas AI-wielding researchers found practical exploitation methods within two weeks. This incident follows recent reports that other AI models have identified thousands of zero-day vulnerabilities in major operating systems and web browsers, underscoring the growing role of artificial intelligence in both finding and patching digital security gaps.