OpenAI Researchers Uncover Major PHP Flaws Using AI Model GPT-5.6 Sol
Researchers using OpenAI's GPT-5.6 Sol discovered significant PHP security flaws that impact 70% of websites.
By Naledi Dlamini ·
OpenAI researchers have discovered major security vulnerabilities in PHP, an open-source programming language that runs an estimated 70% of the internet. The findings came from AI-assisted research conducted by the company’s “Patch the Planet” cybersecurity initiative, which used its advanced AI model GPT-5.6 Sol to uncover the flaws. The PHP Foundation has since released patched versions of PHP to address the vulnerabilities, including PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. These updates follow a coordinated effort among researchers, PHP maintainers, security providers, and government agencies to resolve the issues over a two-month period.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, involve flaws in how PHP manages computer memory and handles errors. The first occurs when PHP runs out of allocated memory while processing a request, potentially leaving behind incomplete internal data that the engine may later mistakenly treat as valid. The second involves a related problem in which a fatal error leaves PHP pointing to memory that has already been freed, allowing subsequent requests to access or corrupt it. Under certain conditions, attackers can exploit these weaknesses remotely, without needing login credentials, to execute malicious code on affected servers, potentially taking control of websites.
Using AI, the researchers also demonstrated that the flaws could expose sensitive information stored in server memory, including passwords, authentication tokens, and API keys. Most concerning, the vulnerabilities exist in PHP's core engine, meaning websites can be affected even if their application code has no security flaws. Both vulnerabilities received a critical severity score of 9.2 out of 10. OpenAI says human developers and security teams examined the underlying code but couldn't fully resolve the flaws, allowing them to persist for two years after discovery. Meanwhile, AI-wielding researchers demonstrated practical ways to exploit it within two weeks.
OpenAI attributes the lengthy timeline to the task's complexity, which required major changes to the PHP engine. The PHP Foundation had known about the underlying flaw since 2024 but couldn't identify an exploitation method or a fix. Calif researcher Ryan A. first identified the exploitable vulnerability on Aug. 11, followed by OpenAI researchers that same day. Subsequently, another cybersecurity firm, Wiz, independently identified an additional vulnerability.
The company highlights the incident as one of the biggest cybersecurity discoveries of 2026, given PHP’s ubiquity. OpenAI considers the Defender's Window concept to be in action, which describes a critical, narrow timeframe during which organizations can use advanced frontier AI models to find, patch, and strengthen their cybersecurity defenses before those same AI-driven attack capabilities become widely available to malicious threat actors. OpenAI argues that powerful, revolutionary technology will inevitably be used by bad actors, and that it is a collective responsibility to act proactively to address any potential exploitable flaws.
Anthropic's Claude Mythos recently identified 'thousands of zero-day vulnerabilities' in 'every major operating system and every major web browser.' This reinforces OpenAI's position that AI is both a powerful tool for defense and a potential threat if not used carefully. The coordinated release was originally scheduled for Oct. 22, but was brought forward to Oct. 21 following premature disclosures on Oct. 20, which led to public outcry.
Source: Tom's Hardware
