70% of the Web Exposed by Flaws Humans Could Not Solve for Two Years
OpenAI reports that its models helped identify and exploit critical vulnerabilities in PHP, a language powering the majority of the internet, which had remained unresolved by human developers.
By Ama Boateng ·
A two-year-old flaw in PHP, the open-source programming language that runs an estimated 70% of the internet, has been turned into working exploits within two weeks by researchers using OpenAI's GPT-5.6 Sol model. This development highlights a widening gap in cybersecurity capabilities, as human developers and security teams examined the underlying code but could not fully resolve the issues, allowing them to persist for two years after discovery. The situation presents a clear conflict: while human experts could not fix the flaw, AI-assisted researchers found ways to exploit it.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are rated with a critical severity score of 9.2 out of 10. They involve how PHP manages computer memory and handles errors, specifically when PHP runs out of allocated memory while processing a request, potentially leaving behind incomplete internal data that the engine may later treat as valid. A related problem involves a fatal error that leaves PHP pointing to memory that has already been freed, allowing subsequent requests to access or corrupt it. Under certain conditions, attackers can exploit these weaknesses remotely without needing login credentials to execute malicious code on affected servers.
Using AI, researchers also demonstrated that these flaws could expose sensitive information stored in server memory, including passwords, authentication tokens, and API keys. Most concerning, the vulnerabilities exist in PHP's core engine, meaning websites can be affected even if their application code has no security flaws. OpenAI says every site using PHP can now safely upgrade its version to stay secure. The company considers this incident one of the biggest cybersecurity discoveries of 2026, given PHP’s ubiquity.
The timeline for the discovery began when researchers from Calif, a California-based cybersecurity firm and the founding partner of OpenAI's 'Patch the Planet' cybersecurity initiative, began auditing PHP with OpenAI tools on July 30, 2026, at the PHP Foundation's request. The Foundation had known about the underlying flaw since 2024 but could not identify an exploitation method or a fix. Calif researcher Ryan A. first identified the exploitable vulnerability on Aug. 11, followed by OpenAI researchers that same day. Subsequently, another cybersecurity firm, Wiz, independently identified an additional vulnerability.
The PHP Foundation has released patched versions PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to fix the vulnerabilities. PHP 8.1 and older versions will not receive official fixes. The coordinated release was originally scheduled for Oct. 22, but was brought forward to Oct. 21 following premature disclosures on Oct. 20, which led to public outcry. OpenAI says it coordinated a coalition of researchers, PHP maintainers, security providers, and government cybersecurity agencies to fix the issues over two months, attributing the lengthy timeline to the task's complexity, which required major changes to the PHP engine.
OpenAI highlights this incident as an example of the Defender's Window concept in action. The company introduced the concept after its models hacked Hugging Face, describing a critical, narrow timeframe during which organizations can use advanced frontier AI models to find, patch, and strengthen their cybersecurity defenses before those same AI-driven attack capabilities become widely available to malicious threat actors. The company argues that powerful, revolutionary technology will inevitably be used by bad actors, and it maintains that it is a collective responsibility to act proactively to address any potential exploitable flaws.
One could argue that the flaws would never have been exploitable without AI, making them effectively harmless, but OpenAI is challenging this view. The company's position on the matter is that the discovery of such vulnerabilities in widely used software is a critical issue that requires immediate attention. The situation is a clear example of how AI can be used to identify and exploit vulnerabilities that human developers could not fix, and it is a clear example of how AI can be used to identify and exploit vulnerabilities that human developers could not fix.
Source: Tom's Hardware
