70% of the Web at Risk: AI Finds Two-Year-Old PHP Flaw

Seventy percent of the internet runs on PHP, a programming language that suddenly found itself at the center of a major security crisis this week. The language powers everything from small business sites to massive enterprise platforms. Now, researchers say they found serious flaws in its core engine. These bugs could allow attackers to take control of servers without needing any login credentials. The discovery highlights a new era of cybersecurity where artificial intelligence finds what humans missed.

OpenAI announced on Tuesday that its GPT-5.6 Sol model helped uncover two critical vulnerabilities. These flaws, tracked as CVE-2026-109618 and CVE-2026-109619, involve how PHP manages memory and handles errors. One bug occurs when the system runs out of memory during a request. This can leave incomplete data that the engine later treats as valid. The second bug happens when a fatal error leaves the system pointing to memory that has already been freed. Attackers can exploit these issues remotely to run malicious code. Both vulnerabilities carry a critical severity score of 9.2 out of 10.

The PHP Foundation knew about the underlying issue since 2024. However, human developers could not find a way to exploit it or fix it. That changed in July, when researchers from Calif, a cybersecurity firm, began auditing the code with OpenAI tools. On August 11, a Calif researcher identified the exploitable vulnerability. OpenAI researchers confirmed it the same day. Another firm, Wiz, independently found a related flaw shortly after. The use of AI allowed the team to turn a stagnant bug into working exploits in just two weeks.

Patched versions of the software are now available. The Foundation released updates for PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Versions 8.1 and older will not receive official fixes. The coordinated release was originally planned for Wednesday. However, it moved to Tuesday after premature disclosures on Monday caused public concern. OpenAI says every site using PHP can safely upgrade to stay secure. The company coordinated this effort with maintainers, security providers, and government agencies over the past two months.

OpenAI calls this incident a prime example of the 'Defender's Window.' This concept describes a narrow timeframe where organizations can use advanced AI to patch defenses before bad actors do. The company argues that powerful technology will eventually be used by attackers. Therefore, it is a collective responsibility to act proactively. This follows a recent report that Anthropic’s Claude Mythos model found thousands of zero-day vulnerabilities in major operating systems and browsers.

There are open questions about the long-term impact of these findings. Some experts argue the flaws were effectively harmless without AI to exploit them. Others say the speed of the AI-assisted discovery changes the calculus. For now, the priority is clear. Website administrators must check their versions and update immediately. The two-month timeline for the fix was due to the complexity of the changes required in the PHP engine. The swift resolution shows that AI can accelerate both the hunt for bugs and the path to security.