70% of the Web Exposed: AI Turns Two-Year-Old PHP Bug Into Critical Threat

Approximately 70% of the internet runs on PHP, a widely used open-source programming language that powers everything from small business sites to major enterprise platforms. On October 21, 2026, OpenAI announced that its GPT-5.6 Sol model had helped uncover critical security vulnerabilities in this foundational software. The discovery highlights a shifting dynamic in cybersecurity, where artificial intelligence is not only creating new risks but also accelerating the detection of long-standing weaknesses that stumped human experts.

The incident centers on two specific flaws, tracked as CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities reside in PHP's core engine and involve fundamental errors in memory management and error handling. The first issue arises when the engine runs out of allocated memory during a request, potentially leaving behind incomplete data that is later misinterpreted as valid. The second occurs when a fatal error leaves the system pointing to memory that has already been freed, allowing subsequent requests to access or corrupt that space. Both flaws carry a critical severity score of 9.2 out of 10.

The PHP Foundation first became aware of the underlying defect in 2024. However, human developers and security teams were unable to identify a method to exploit the bug or a reliable fix, allowing the issue to persist for two years. The breakthrough came when researchers from Calif, a California-based cybersecurity firm and founding partner in OpenAI's Patch the Planet initiative, began auditing the language with AI tools on July 30, 2026. On August 11, Calif researcher Ryan A. identified the exploitable vulnerability, with OpenAI researchers confirming it the same day. A separate firm, Wiz, independently identified a related vulnerability around the same time.

The use of AI proved decisive in demonstrating that these theoretical flaws could be weaponized. Within two weeks of the initial discovery, researchers using AI tools developed practical exploits. These exploits allow attackers to remotely execute malicious code on affected servers without requiring login credentials. Furthermore, the vulnerabilities could expose sensitive data stored in server memory, such as passwords, authentication tokens, and API keys. Crucially, because the flaws exist in the core engine, websites can be compromised even if their specific application code is secure.

Following the discovery, OpenAI coordinated a coalition involving PHP maintainers, security providers, and government cybersecurity agencies to develop fixes. This process took two months due to the complexity of making major changes to the PHP engine. The coordinated release of patched versions, including PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, was originally scheduled for October 22. However, premature disclosures on October 20 led to public outcry, prompting the organization to bring the release forward to October 21. Users of PHP 8.1 and older versions will not receive official fixes and must upgrade to newer releases.

OpenAI framed this event as a prime example of its Defender's Window concept. Introduced after its models hacked Hugging Face, this theory suggests there is a narrow timeframe during which organizations can use frontier AI to find and patch defenses before those same capabilities become widely available to malicious actors. The company argues that because powerful technology will inevitably be used by bad actors, it is a collective responsibility to proactively address exploitable flaws. OpenAI considers this one of the biggest cybersecurity discoveries of 2026 given the ubiquity of PHP.

The situation has sparked debate about the nature of AI-driven security. One perspective is that the flaws would never have been exploitable without AI, rendering them effectively harmless. OpenAI challenges this view, pointing to recent findings by Anthropic's Claude Mythos, which identified thousands of zero-day vulnerabilities in major operating systems and web browsers. The company maintains that the ability to find these flaws is only the first step; the critical factor is how quickly defenders can respond.

For readers in the Great Lakes and Ohio Valley, the impact is immediate. Many local government services, healthcare portals, and small business websites rely on PHP. The urgency to upgrade stems not just from the presence of the bug, but from the speed with which AI can turn dormant code into active threats. As the industry moves toward AI-assisted auditing, the window for traditional manual review continues to narrow.

The coordinated response underscores the growing reliance on AI in maintaining the web's infrastructure. While the initial discovery was made by a specialized firm, the integration of OpenAI's tools allowed for a rapid transition from theoretical risk to practical understanding. This speed is expected to become the norm as more cybersecurity initiatives adopt similar AI-driven methodologies.

OpenAI states that every site using PHP can now safely upgrade its version to remain secure. The company emphasizes that this incident validates the effectiveness of using advanced models for defensive purposes. As the digital landscape evolves, the balance between offensive and defensive AI capabilities will likely define the next phase of cybersecurity strategy.