Critical PHP Flaws Fixed After AI-Assisted Audit Targets Vast Web Infrastructure

Updated software patches for the PHP programming language were released on October 21, 2026, addressing critical security flaws in the software. The PHP Foundation issued fixed versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to resolve the vulnerabilities. This release occurred one day ahead of the original schedule set for October 22, following public outcry that arose after details about the flaws were disclosed prematurely on October 20. Official patches will not be provided for PHP 8.1 or older versions of the language.

The vulnerabilities, designated as CVE-2026-109618 and CVE-2026-109619, were identified through an audit conducted under OpenAI’s “Patch the Planet” cybersecurity initiative. The audit began on July 30, 2026, at the request of the PHP Foundation. OpenAI stated that researchers utilized its GPT-5.6 Sol model to uncover the issues. The investigation involved a coalition that included the PHP Foundation, security providers, and government cybersecurity agencies.

According to OpenAI, human developers had examined the underlying code regarding one of these issues for two years since its discovery in 2024 but were unable to devise a fix or identify a method for exploitation. In contrast, researchers utilizing AI tools identified a way to exploit the vulnerability on August 11, 2026, and demonstrated working exploits within two weeks of the audit's commencement. The coordinated effort to address the vulnerabilities and deploy fixes was completed over a period of two months.

The security flaws are located within PHP's core engine, which presents a significant risk to website operators. Because the issues reside in the engine, websites can be affected regardless of whether their specific application code contains security vulnerabilities. The flaws involve how the software handles memory and errors, potentially allowing attackers to execute malicious code on affected servers without requiring login credentials. Both vulnerabilities are rated with a critical severity score of 9.2 out of 10.

The exploitation of these memory management issues could lead to the disclosure of sensitive information stored in server memory, including passwords, authentication tokens, and API keys. An estimated 70% of websites utilize PHP, making the potential impact of these vulnerabilities widespread across the internet. OpenAI considers this incident one of the major cybersecurity discoveries of 2026 given the ubiquity of the programming language.

The company has characterized this event as an example of the “Defender’s Window,” a concept it introduced following incidents involving its own models hacking Hugging Face. This concept describes a specific period during which organizations can utilize advanced AI models to strengthen defenses before those same capabilities become available to malicious actors. OpenAI maintains that powerful technology will inevitably be used by bad actors, making it a collective responsibility to proactively address potential exploitable flaws.

OpenAI’s announcement comes as other AI models are also identifying software weaknesses. Anthropic’s Claude Mythos recently identified thousands of zero-day vulnerabilities in every major operating system and every major web browser. OpenAI states that every site using PHP can now safely upgrade its version to maintain security.