AI Finds Critical Web Security Flaws

OpenAI revealed yesterday that its GPT-5.6 Sol model helped researchers discover critical security vulnerabilities in PHP, the open-source language powering an estimated 70% of the internet. The discovery, made under the company’s “Patch the Planet” cybersecurity initiative, led to a coordinated effort involving PHP maintainers, security firms, and government agencies to deploy fixes over a two-month period. OpenAI cited the complexity of the issue, which required substantial changes to the PHP engine, as the reason for the extended timeline before the patches were ready.

The PHP Foundation has issued updated versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the issues, though versions 8.1 and older remain without official fixes. The release was accelerated to yesterday, October 21, after premature disclosures on October 20 sparked public concern. Originally scheduled for today, the early rollout ensures that every site using PHP can upgrade immediately to maintain security.

Two specific vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, stem from flaws in memory management and error handling. The first occurs when PHP runs out of allocated memory during a request, potentially leaving incomplete data that the engine later treats as valid. The second involves a fatal error leaving the system pointing to freed memory, allowing subsequent requests to access or corrupt it. Both flaws carry a critical severity score of 9.2 out of 10 and exist in the core engine, meaning websites can be compromised even if their application code is secure.

Researchers from Calif, a California-based cybersecurity firm and founding partner of the initiative, began auditing PHP with OpenAI tools on July 30 at the Foundation's request. The Foundation had known about the underlying flaw since 2024 but could not determine how to exploit or fix it. Calif researcher Ryan A. identified the exploitable vulnerability on August 11, with OpenAI researchers confirming it the same day. Security firm Wiz independently found the second vulnerability shortly after.

The AI-assisted team demonstrated that these flaws could be exploited remotely without login credentials to execute malicious code and steal sensitive data like passwords and API keys. While human developers struggled to resolve the issue for two years, the AI-enabled researchers developed working exploits in just two weeks. OpenAI frames this as evidence of the “Defender's Window,” a concept suggesting organizations must use frontier AI to patch defenses before attackers gain similar capabilities.

The company argues that powerful technology will inevitably be used by bad actors, making proactive defense a collective responsibility. This stance challenges the view that flaws are harmless if they are not yet exploitable by humans. With Anthropic’s Claude Mythos recently identifying thousands of zero-day vulnerabilities in major operating systems and browsers, OpenAI suggests the industry is entering a new phase of AI-driven cybersecurity challenges.