Web Security: AI Model Finds Critical Flaws Affecting Most of the Internet

The majority of the web runs on PHP, an open-source language that powers roughly 70 percent of internet sites, making any weakness in its core engine a significant risk for global connectivity. On October 21, 2026, OpenAI announced that its GPT-5.6 Sol model had helped uncover critical security vulnerabilities in this foundational software.

The discovery was part of a broader initiative called Patch the Planet, which aims to use advanced artificial intelligence to harden digital infrastructure. Researchers from Calif, a cybersecurity firm and founding partner in the program, began auditing PHP at the request of the PHP Foundation on July 30. Although the Foundation had been aware of the underlying defect since 2024, human developers had struggled to find a way to exploit it or fix it for two years. Using the AI tool, researchers identified an exploitable vulnerability on August 11. Shortly after, another firm named Wiz independently found a second related flaw.

These two issues, assigned the identifiers CVE-2026-109618 and CVE-2026-109619, stem from how PHP manages memory and handles errors. The first flaw occurs when the system runs out of allocated memory during a request, leaving behind incomplete data that the engine may later treat as valid. The second issue involves a fatal error that leaves the software pointing to memory that has already been freed. In both cases, attackers can remotely exploit these weaknesses without login credentials to run malicious code or steal sensitive data like passwords and API keys. Both vulnerabilities were rated with a critical severity score of 9.2 out of 10.

Following the discovery, OpenAI coordinated with PHP maintainers, security providers, and government agencies to develop a fix. The process took two months due to the complexity of the required changes to the PHP engine. The PHP Foundation released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the issues. Versions 8.1 and older will not receive official updates. The release was originally planned for October 22 but was moved to October 21 after premature disclosures on October 20 caused public concern.

OpenAI described this incident as a prime example of the Defender's Window, a concept the company introduced after its models were used to hack Hugging Face. The idea suggests there is a narrow period where organizations can use frontier AI to find and patch flaws before attackers gain the same capability. The company argued that since powerful technology will inevitably be used by bad actors, it is a collective responsibility to address exploitable flaws proactively. This view contrasts with the argument that the flaws would have remained harmless without AI assistance to exploit them.

The rapid turnaround from discovery to working exploit in just two weeks highlighted the shift in cybersecurity dynamics. Human teams had examined the code for two years without success, while AI-assisted researchers demonstrated practical exploitation quickly. OpenAI noted that this event is considered one of the most significant cybersecurity findings of 2026 due to the widespread use of PHP. The company also pointed to recent reports from Anthropic, whose Claude Mythos model identified thousands of zero-day vulnerabilities in major operating systems and web browsers, reinforcing the urgency of this new era of automated security auditing.

For web administrators, the immediate action is to upgrade to one of the patched versions to ensure safety. The incident underscores that even stable, long-standing software can harbor critical risks that are difficult for humans to detect but can be rapidly resolved by modern AI tools. As these models become more prevalent, the window for defenders to stay ahead of attackers continues to evolve.