AI finds critical flaws in core web engine

Websites operating on the widely used PHP engine must update their software immediately to secure their infrastructure. The PHP Foundation issued emergency patches on Tuesday, October 21, to correct critical vulnerabilities that could allow remote attackers to take control of servers. Because PHP powers an estimated 70 percent of the internet, the discovery has significant implications for digital commerce and online services. The coordinated release was pulled forward from its scheduled date on Wednesday, October 22, following premature disclosures on Monday that triggered public concern.

The flaws, identified as CVE-2026-109618 and CVE-2026-109619, stem from errors in how the engine manages memory and processes fatal errors. Specifically, the system could retain incomplete internal data when running out of allocated memory or point to memory that has already been freed. These conditions enable attackers to execute malicious code without login credentials, potentially exposing sensitive data such as passwords, authentication tokens, and API keys. Both issues received a critical severity score of 9.2 out of 10.

The discovery was made by researchers from Calif, a cybersecurity firm and founding partner of OpenAI’s Patch the Planet initiative. Working at the request of the PHP Foundation, they began auditing the code on July 30, 2026. Calif researcher Ryan A. identified an exploitable vulnerability on August 11, followed by OpenAI researchers on the same day. Separately, the firm Wiz independently found an additional flaw. The PHP Foundation had been aware of the underlying code issues since 2024 but had been unable to determine how to exploit them or implement a fix.

OpenAI attributes the swift resolution to its GPT-5.6 Sol model, which helped turn a two-year-old bug into working exploits within two weeks. Human developers had examined the code for that duration without success, whereas AI-assisted researchers quickly demonstrated practical exploitation methods. The company argues this efficiency validates its Defender's Window concept, a timeframe where organizations can use advanced AI to patch defenses before malicious actors deploy similar capabilities.

The fix required major changes to the PHP engine, leading to a two-month coordination effort involving researchers, maintainers, security providers, and government agencies. The Foundation released patched versions for PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Sites using PHP 8.1 or older versions will not receive official fixes and must upgrade their versions to remain secure. OpenAI describes this incident as one of the most significant cybersecurity discoveries of 2026 due to the language's ubiquity.

The company challenges the notion that these flaws were harmless because they required AI to become exploitable. Instead, OpenAI maintains that powerful technology will inevitably be used by bad actors, making it a collective responsibility to address potential vulnerabilities proactively. This stance follows recent findings by Anthropic, whose Claude Mythos model identified thousands of zero-day vulnerabilities across major operating systems and web browsers.

For market participants, the incident underscores the growing role of AI in both creating and mitigating cyber risks. The ability to exploit core engine flaws without application-level errors means that even well-maintained websites remain vulnerable. As AI models become more sophisticated in finding security gaps, the cost of inaction for web developers increases, particularly for those relying on older, unsupported versions of foundational software.

The rapid timeline from discovery to patch release highlights the pressure on open-source maintainers to respond to AI-accelerated threat detection. While the flaws had existed for two years, their transition from theoretical to practical risk occurred in a matter of weeks. This shift suggests that the window for defenders to secure their assets is narrowing, requiring faster integration of AI tools in routine security audits.