70 Percent of the Web Affected by Critical PHP Flaws Found by AI

The infrastructure supporting a significant portion of the global web is built upon a specific open-source programming language that powers an estimated 70 percent of all websites. A recent announcement by OpenAI has revealed that this foundational technology contained severe security weaknesses that had remained undetected in terms of practical exploitation for two years.

On October 21, OpenAI disclosed that researchers participating in its Patch the Planet cybersecurity initiative utilized the GPT-5.6 Sol model to identify critical vulnerabilities in PHP. The company stated that a coalition of researchers, maintainers, security providers, and government agencies worked together over a two-month period to address the issues. OpenAI attributed the extended timeline to the complexity of the task, which necessitated substantial changes to the core PHP engine.

The timeline of the discovery began in July 2026 when the PHP Foundation requested an audit of its codebase. Although the Foundation had been aware of an underlying flaw since 2024, human developers had been unable to determine a method for exploitation or a complete fix. On August 11, a researcher from Calif, a California-based cybersecurity firm and founding partner of the initiative, identified an exploitable vulnerability. OpenAI researchers confirmed the finding on the same day, while another firm, Wiz, independently discovered a second related flaw.

The two identified vulnerabilities, designated as CVE-2026-109618 and CVE-2026-109619, stem from errors in how PHP manages computer memory and processes errors. The first issue arises when the system runs out of allocated memory during a request, potentially leaving incomplete data that is later treated as valid. The second involves a fatal error that causes the system to point to memory that has already been released, allowing subsequent requests to access or corrupt that space. Both flaws received a critical severity score of 9.2 out of 10.

These weaknesses allow attackers to execute malicious code remotely without login credentials, potentially granting control over affected servers. Researchers also demonstrated that the flaws could expose sensitive data stored in server memory, such as passwords and authentication tokens. Because the vulnerabilities exist in the core engine, websites are at risk even if their specific application code is secure.

The PHP Foundation released patched versions for PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to resolve the issues. Versions 8.1 and older will not receive official fixes. The coordinated release was originally planned for October 22 but was moved forward to October 21 following premature disclosures on October 20 that generated public concern. OpenAI advised that all sites using the language can safely upgrade to remain secure.

OpenAI described the incident as an example of the Defender's Window concept, a term the company introduced after its models were used to hack Hugging Face. This concept refers to a narrow timeframe during which organizations can use advanced AI models to find and patch vulnerabilities before those capabilities become widely available to malicious actors. The company argues that it is a collective responsibility to proactively address exploitable flaws, noting that human teams had struggled to resolve the code issues for two years, while AI-assisted researchers developed working exploits in just two weeks.

The company maintains that powerful technology will inevitably be used by bad actors, making proactive defense essential. This perspective follows recent reports that Anthropic's Claude Mythos model identified thousands of zero-day vulnerabilities in major operating systems and web browsers. For the Pacific Northwest and the broader tech community, the event underscores the shifting dynamics of cybersecurity in an era of advanced artificial intelligence.