PHP Patch Deadline Shifts After AI Unearths Critical Flaws in Web Backbone

The digital infrastructure that supports the majority of the global web faced a significant stress test this week as OpenAI confirmed that its AI model GPT-5.6 Sol helped uncover critical vulnerabilities in PHP. The language, which underpins an estimated 70% of websites, contains memory management flaws that allow remote attackers to execute malicious code without login credentials. This discovery has forced a rapid, coordinated response from the PHP Foundation and security firms to patch the core engine before these weaknesses become widespread attack vectors.

The urgency of the situation escalated when premature disclosures emerged on October 20, prompting the PHP Foundation to move the scheduled release of patched versions forward to October 21. The updated releases, including versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, address two specific critical bugs. Notably, older versions of PHP 8.1 and below will not receive official fixes, leaving a segment of the market exposed unless they upgrade to newer versions.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, stem from how PHP handles memory allocation and error states. The first issue arises when the system runs out of allocated memory during a request, potentially leaving incomplete data that the engine later misinterprets as valid. The second involves a fatal error that leaves the system pointing to freed memory, allowing subsequent requests to corrupt or access that space. Both flaws carry a critical severity score of 9.2 out of 10, highlighting their potential to compromise server stability and data integrity.

The timeline of the discovery reveals a stark contrast between human and AI capabilities in security auditing. The PHP Foundation had been aware of the underlying flaw since 2024 but lacked a method to exploit or fix it. In July 2026, researchers from Calif, a founding partner in OpenAI’s Patch the Planet initiative, began auditing the code using OpenAI tools. By August 11, these AI-assisted researchers identified the exploitable vulnerability, a process that human teams had struggled with for two years. A separate firm, Wiz, independently identified the second vulnerability shortly after.

OpenAI frames this incident as a prime example of its Defender's Window concept. This theory suggests there is a narrow timeframe where advanced AI models can be used to fortify defenses before those same capabilities are widely adopted by malicious actors. The company argues that proactive patching is a collective responsibility, especially as other AI systems, such as Anthropic's Claude Mythos, have recently identified thousands of zero-day vulnerabilities in major operating systems and browsers.

The market impact extends beyond immediate patching, as the flaws exist in the core PHP engine rather than in application-specific code. This means that even well-coded websites are vulnerable if they run on an unpatched version of the language. The ability of AI to expose sensitive data, including passwords and API keys, from server memory adds a financial risk for companies that rely on these platforms for customer interactions and data storage.

Looking ahead, the incident underscores the growing role of AI in identifying complex software defects. While some argue that flaws only exploitable by AI are less critical, the industry is moving toward a model of defensive automation. For businesses, the immediate action is clear: audit current PHP versions and upgrade to the latest patched releases to mitigate the risk of remote code execution in a landscape where AI-driven attacks are becoming increasingly common.