OpenAI and Calif Expose Critical PHP Flaws Affecting Majority of Web Sites
A two-year-old memory management error in PHP was turned into a working exploit by AI-assisted researchers, prompting emergency patches for 70% of the internet's infrastructure.
By Dmitri Sokolov ·
OpenAI and its founding partner in the Patch the Planet initiative, Calif, announced on October 21 that they have identified critical security vulnerabilities in PHP, the open-source language that powers an estimated 70% of the web. By leveraging the GPT-5.6 Sol model, researchers transformed a known but unexploitable defect into a functional attack vector, a process that took only two weeks compared to the two years human developers spent attempting to resolve the underlying issue without success.
The discovery stems from a collaborative effort initiated at the request of the PHP Foundation. Researchers began auditing the codebase on July 30, 2026, and successfully identified the exploitable flaw on August 11. A second, related vulnerability was independently detected by the cybersecurity firm Wiz. Both issues, designated as CVE-2026-109618 and CVE-2026-109619, reside in the core PHP engine, meaning websites are vulnerable even if their application-level code is secure. The flaws involve memory management errors that can leave incomplete data or point to freed memory, allowing remote attackers to execute malicious code without login credentials. Both vulnerabilities carry a critical severity score of 9.2 out of 10.
Following the discovery, OpenAI coordinated a broad coalition including PHP maintainers, security providers, and government agencies to develop fixes. This process required significant changes to the PHP engine, extending the remediation timeline to two months. The PHP Foundation has released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Sites running PHP 8.1 or older will not receive official fixes and must upgrade. While the coordinated release was planned for October 22, premature disclosures on October 20 forced the announcement to be brought forward to October 21.
The incident highlights what OpenAI terms the Defender's Window, a concept introduced after its models previously compromised Hugging Face. This theory suggests there is a narrow timeframe during which organizations can utilize frontier AI to strengthen defenses before malicious actors gain access to similar capabilities. OpenAI argues that because powerful technology will inevitably be used by bad actors, proactive patching is a collective responsibility. The company notes that human teams had examined the code for two years without a fix, whereas AI-assisted researchers demonstrated practical exploitation methods in just two weeks.
For the Great Lakes and Ohio Valley, the significance of PHP lies in its ubiquity. Regional e-commerce platforms, local government portals, and small business websites likely rely on this language. The ability for attackers to remotely access sensitive server memory, including passwords and API keys, underscores the shifting landscape of digital security. As AI tools become more prevalent in both offensive and defensive cybersecurity, the speed at which vulnerabilities can be found and exploited is compressing the response window for developers and system administrators.
Source: Tom's Hardware
