OpenAI Credits AI Model for Solving Two-Year-Old PHP Security Crisis

OpenAI announced on Oct. 21 that researchers operating under its Patch the Planet initiative used the GPT-5.6 Sol model to identify critical security weaknesses in PHP, the open-source language powering an estimated 70% of the internet. The company stated that this discovery triggered a coordinated effort involving PHP maintainers, security providers, and government agencies to resolve the issues within two months. OpenAI attributed the extended repair timeline to the complexity of the task, which necessitated significant modifications to the core PHP engine.

The timeline of the incident reveals a flaw that had persisted since 2024. The PHP Foundation was aware of the underlying issue but lacked the means to determine an exploitation method or a viable fix. On July 30, 2026, researchers from Calif, a California-based cybersecurity firm and founding partner of Patch the Planet, began auditing PHP using OpenAI tools at the Foundation's request. Just over a month later, on Aug. 11, Calif researcher Ryan A. identified the first exploitable vulnerability. OpenAI researchers confirmed the finding the same day, and another firm, Wiz, independently discovered a second related flaw.

The vulnerabilities, designated as CVE-2026-109618 and CVE-2026-109619, stem from errors in how PHP manages computer memory and processes fatal errors. The first flaw occurs when the engine runs out of allocated memory, potentially leaving incomplete internal data that is later misinterpreted as valid. The second involves the engine pointing to memory that has already been freed, allowing subsequent requests to access or corrupt it. Both issues carry a critical severity score of 9.2 out of 10.

Remote attackers can exploit these weaknesses without login credentials to execute malicious code on affected servers. The flaws can also expose sensitive data in server memory, such as passwords and API keys. Because the vulnerabilities reside in the core engine, websites are susceptible even if their application code is secure. The PHP Foundation released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 on Oct. 21. Older versions, including PHP 8.1, will not receive official fixes. The release was moved up from Oct. 22 after premature disclosures on Oct. 20 caused public concern.

OpenAI highlighted this incident as a prime example of its Defender's Window concept, a timeframe where organizations can use advanced AI to strengthen defenses before malicious actors gain similar capabilities. The company noted that human developers had examined the code for two years without success, whereas AI-assisted researchers created working exploits within two weeks. OpenAI argues that proactive patching is a collective responsibility, noting that Anthropic’s Claude Mythos recently identified thousands of zero-day vulnerabilities in major operating systems and browsers.

The company maintains that powerful technology will inevitably be used by bad actors, making immediate action essential. OpenAI encourages all PHP users to upgrade to the latest secure versions. This event is considered one of the most significant cybersecurity discoveries of 2026 due to the ubiquity of the language. The coordinated response demonstrates the growing role of artificial intelligence in identifying and resolving complex software vulnerabilities that have previously eluded human detection.