PHP Patch Cycle: AI-Driven Audit Exposes Critical Flaws in 70% of Web Infrastructure
OpenAI and partners identified two severe memory vulnerabilities in PHP, prompting an emergency release of security patches for major server versions to mitigate remote execution risks.
By Tunde Adeyemi ·
The PHP Foundation released updated versions of its software on Tuesday, October 21, moving the coordinated disclosure forward by one day due to premature public information leaks. The patch cycle addresses two critical security vulnerabilities that affect an estimated 70% of the internet’s underlying infrastructure. The emergency update includes versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, while older iterations, including PHP 8.1 and earlier, are excluded from official fixes. This rapid response follows a two-month coordination effort involving researchers, maintainers, and government agencies to resolve complex issues within the PHP engine.
OpenAI announced the findings on Monday, October 20, stating that researchers operating under its "Patch the Planet" initiative used the GPT-5.6 Sol model to identify the flaws. The company characterized the discovery as one of the most significant cybersecurity events of 2026, given the ubiquity of PHP in web development. The incident serves as a practical example of what OpenAI calls the "Defender's Window," a concept suggesting a narrow timeframe where organizations can use advanced AI to secure systems before malicious actors gain similar capabilities. This framework was previously introduced after OpenAI’s models successfully hacked Hugging Face.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, stem from errors in memory management and error handling. The first flaw occurs when PHP exhausts its allocated memory during request processing, potentially leaving incomplete internal data that the engine later misinterprets as valid. The second involves a fatal error that leaves the system pointing to memory that has already been freed, allowing subsequent requests to access or corrupt that space. Both issues received a critical severity score of 9.2 out of 10, indicating a high risk of significant system compromise.
Audit work began on July 30, 2026, at the request of the PHP Foundation. Researchers from Calif, a California-based cybersecurity firm and founding partner of the Patch the Planet program, initiated the review using OpenAI tools. On August 11, Calif researcher Ryan A. identified the first exploitable vulnerability, a finding matched by OpenAI researchers the same day. Independently, another cybersecurity firm named Wiz identified the second vulnerability. The PHP Foundation had been aware of the underlying flaw since 2024 but had previously failed to determine an exploitation method or a viable fix.
The use of AI in this process highlighted a shift in how security flaws are discovered and exploited. While human developers examined the code for two years without a resolution, AI-assisted teams demonstrated practical exploitation methods within two weeks. OpenAI noted that the flaws could allow remote attackers to execute malicious code without login credentials, potentially granting control over affected servers. Furthermore, the vulnerabilities could expose sensitive data stored in server memory, including passwords, authentication tokens, and API keys. Because the issues reside in the core engine, websites are vulnerable even if their specific application code is secure.
OpenAI argues that the persistence of these flaws for two years underscores the necessity of proactive defense in an era of advanced AI. The company maintains that powerful technology will inevitably be adopted by threat actors, making it a collective responsibility to address exploitable weaknesses. This stance contrasts with the view that flaws which require AI to exploit are effectively harmless. The company points to recent findings by Anthropic’s Claude Mythos, which identified thousands of zero-day vulnerabilities in major operating systems and web browsers, as evidence of the accelerating pace of AI-driven security research.
For businesses relying on PHP, the immediate action required is to upgrade to the patched versions to ensure continued security. The incident illustrates the growing intersection of artificial intelligence and infrastructure maintenance, where the speed of discovery now outpaces traditional human-led development cycles. As AI models become more capable, the window for defenders to patch critical systems before attackers exploit them continues to narrow, demanding faster response times from global web infrastructure providers.
Source: Tom's Hardware
