AI Model Assists in Patching Critical Flaws in Code Running 70% of Websites
Patched versions of PHP were released to address vulnerabilities that researchers could not exploit for two years until AI-assisted teams found a way to do so in weeks.
By Jonathan Pierce ·
Updated versions of the PHP programming language were released Wednesday to address critical security vulnerabilities in a core component of the software, which underpins an estimated 70% of the internet. The patches arrived a day ahead of schedule after details about the flaws became public on Oct. 20.
The PHP Foundation issued fixes in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Users of older versions will not receive official security updates. The coordinated release, originally set for Oct. 22, was accelerated in response to public concern following the premature disclosures.
The flaws were uncovered by researchers working with OpenAI's GPT-5.6 Sol model under the company's "Patch the Planet" cybersecurity program. The effort began on July 30 at the request of the PHP Foundation, which had known about the underlying defect since 2024 but had been unable to identify a method to exploit it or a fix.
Researchers from Calif, a California-based cybersecurity firm and founding partner of the program, first identified an exploitable path on Aug. 11. OpenAI researchers confirmed the finding the same day, and a separate firm, Wiz, later identified an additional vulnerability. Over the following two months, a coalition of researchers, PHP maintainers, security providers, and government cybersecurity agencies coordinated to address the issues.
The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, involve how PHP manages memory and handles errors. In one case, running out of memory during a request can leave behind incomplete data that the system later treats as valid. In the other, a fatal error can leave the software pointing to memory that has already been freed, which subsequent requests may access or corrupt. Both flaws received a critical severity score of 9.2 out of 10.
Under certain conditions, the vulnerabilities can be exploited remotely without login credentials to execute malicious code on a server. Researchers also demonstrated the flaws could expose sensitive information in server memory, including passwords, authentication tokens, and API keys.
The flaws are located in PHP's core engine, meaning websites can be affected even if their own application code contains no security issues. OpenAI noted that human developers and security teams had examined the underlying code but could not fully resolve the flaws, allowing them to persist for two years after discovery. By contrast, AI-assisted researchers demonstrated working exploits in two weeks.
The company cited the incident as an example of its Defender's Window concept, which describes a narrow period when organizations can use advanced AI models to find and patch vulnerabilities before those same capabilities become available to attackers. OpenAI stated that it considers the discovery one of the biggest cybersecurity events of 2026 given PHP's ubiquity.
The company further argued that powerful technology will inevitably be used by bad actors, and that it is a collective responsibility to proactively address potential flaws. In a related development, Anthropic's Claude Mythos recently identified thousands of zero-day vulnerabilities across major operating systems and web browsers.
Source: Tom's Hardware
