OpenAI AI model exposed critical PHP flaws affecting 70% of web traffic

The PHP Foundation has released emergency updates for its latest software versions to fix two serious security holes. These patches, released on October 21, 2026, address flaws that could allow attackers to take control of websites without needing a login. The release came one day earlier than planned because details about the vulnerabilities leaked publicly on October 20, prompting a rush to secure the internet's infrastructure.

The discovery was led by researchers working under OpenAI's Patch the Planet cybersecurity initiative. They utilized the company's GPT-5.6 Sol AI model to audit the PHP codebase. PHP is an open-source language that powers an estimated 70% of the internet, making this a significant event for web security. OpenAI describes this incident as one of the most important cybersecurity findings of the year.

There are two main issues in how PHP handles memory and errors. The first occurs when the system runs out of allocated memory during a request. This can leave behind incomplete data that the engine might later mistake for valid information. The second issue involves a fatal error that leaves the system pointing to memory that has already been freed. This allows subsequent requests to access or corrupt that memory. Both vulnerabilities have been assigned a critical severity score of 9.2 out of 10.

The timeline for fixing these problems was complex. The PHP Foundation had actually known about the underlying code flaw since 2024. However, human developers could not find a way to exploit it or create a reliable fix for two years. In July 2026, the Foundation asked Calif, a California-based cybersecurity firm, to help audit the code using OpenAI tools. On August 11, a Calif researcher identified an exploitable path, and OpenAI researchers confirmed it that same day. Another firm, Wiz, independently found a related vulnerability shortly after.

Once the AI-assisted team identified the weaknesses, they worked with PHP maintainers and government agencies for two months to develop a solution. The process required major changes to the PHP engine. The specific patched versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Users running PHP 8.1 or older versions will not receive official fixes for these specific issues.

The vulnerabilities allow for remote exploitation without credentials. Attackers could potentially execute malicious code on affected servers. The researchers also demonstrated that the flaws could expose sensitive data stored in server memory, such as passwords, authentication tokens, and API keys. Because the bugs exist in the core engine, even websites with perfect application code could still be vulnerable.

OpenAI is using this incident to illustrate a concept it calls the Defender's Window. The idea is that there is a narrow period where organizations can use advanced AI to find and patch weaknesses before bad actors gain access to the same tools. The company argues that since powerful technology will eventually be used by attackers, it is a collective responsibility to act proactively. This view follows a similar announcement by Anthropic, whose models recently identified thousands of zero-day vulnerabilities in major operating systems and browsers.

For the Southeast and web developers everywhere, the immediate step is to check your PHP version. If you are on one of the supported versions listed by the Foundation, upgrading now is the safest move. While the bugs had been sitting in the code for years, the ability to exploit them quickly with AI changes the urgency for site administrators.