AI-Assisted Audit Closes Critical PHP Flaws Rated 9.2

An estimated 70% of websites rely on PHP to run, and a critical vulnerability in the language's core engine could have been exploited to take control of affected sites. Following a coordinated patching effort, fixed versions of the programming language are now available to the public.

OpenAI announced on Oct. 21 that researchers working with its cybersecurity initiative successfully uncovered these serious security flaws. After the discovery, a coalition of security professionals, language maintainers, and government agencies worked together for two months to create and deploy the necessary fixes. OpenAI stated that the extended timeline was due to the task's complexity, as it required major changes to the PHP engine itself.

The PHP Foundation has released patched versions to address the vulnerabilities, specifically PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. However, those using PHP 8.1 or older versions will not receive official fixes. The coordinated release of these updates was originally planned for Oct. 22 but was moved forward to Oct. 21 after premature disclosures on Oct. 20 caused public outcry.

The timeline for this discovery began on July 30, 2026, when researchers from Calif, a California-based cybersecurity firm, began auditing the code at the PHP Foundation's request. The Foundation had been aware of an underlying flaw since 2024 but had been unable to identify a way to exploit it or develop a fix for it. That changed when Calif researcher Ryan A. first identified an exploitable vulnerability on Aug. 11, 2026, a discovery that was replicated by other researchers that same day.

Following this, another cybersecurity firm, Wiz, independently found an additional vulnerability. The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are related to how PHP manages computer memory and handles errors. The first flaw occurs when PHP runs out of allocated memory while processing a request, potentially leaving behind incomplete data that the engine may later treat as valid. The second involves a fatal error that leaves PHP pointing to memory that has already been freed, allowing subsequent requests to access or corrupt it. Under certain conditions, attackers can exploit these weaknesses remotely, without needing login credentials, to execute malicious code on a server.

Using AI, the researchers also demonstrated that these vulnerabilities could expose sensitive information stored in server memory, such as passwords, authentication tokens, and API keys. Because the vulnerabilities exist in PHP's core engine, websites can be affected even if their own application code contains no security flaws. Both vulnerabilities received a critical severity score of 9.2 out of 10.

OpenAI noted that human developers and security teams had examined the underlying code but could not fully resolve the flaws, allowing them to persist for two years after discovery. In contrast, AI-assisted researchers demonstrated practical ways to exploit the issue within two weeks. The company highlighted the incident as an example of its 'Defender's Window' concept. OpenAI introduced this concept after its models hacked Hugging Face, describing it as a critical, narrow timeframe during which organizations can use advanced AI models to find and patch their cybersecurity defenses before those same capabilities become widely available to malicious actors.

OpenAI is challenging the view that such flaws are harmless if they are not yet being exploited by bad actors. The company maintains that it is a collective responsibility to act proactively against any potential exploitable flaws because revolutionary technology will inevitably be used for malicious purposes. This comes as Anthropic's Claude Mythos recently identified 'thousands of zero-day vulnerabilities' in 'every major operating system and every major web browser.'

OpenAI says every site using PHP can now safely upgrade its version to stay secure. The company considers this incident one of the biggest cybersecurity discoveries of 2026, given PHP’s ubiquity.