OpenAI AI Model Exposes Critical Flaws Affecting 70 Percent of Websites

The open-source PHP language, which powers an estimated 70 percent of the web, is now the focus of a major security overhaul after artificial intelligence helped turn a dormant bug into a critical threat. OpenAI announced on October 21 that its GPT-5.6 Sol model, deployed under the Patch the Planet initiative, identified severe vulnerabilities that had eluded human developers for two years. The discovery has triggered a rapid coordination effort among maintainers, security firms, and government agencies to deploy fixes before the weaknesses are widely exploited.

The incident highlights a significant shift in cybersecurity dynamics, where AI tools are not only finding flaws but also demonstrating practical methods for exploitation. OpenAI stated that researchers from Calif, a founding partner in the Patch the Planet program, began auditing the PHP engine on July 30 at the request of the PHP Foundation. Although the Foundation had been aware of the underlying flaw since 2024, they could not determine how to exploit it or how to fix it. That changed on August 11 when Calif researcher Ryan A. identified the exploitable vulnerability, with OpenAI researchers confirming the finding on the same day.

The process moved from theoretical discovery to active threat assessment within two weeks. AI-assisted researchers demonstrated that the flaws could be leveraged to create working exploits, a task that had previously stumped human security teams. A separate firm, Wiz, independently identified an additional vulnerability during the same period. The two issues are tracked as CVE-2026-109618 and CVE-2026-109619 and involve critical errors in how PHP manages computer memory and processes errors.

The technical specifics of the flaws are particularly dangerous for web administrators. The first vulnerability occurs when PHP runs out of allocated memory, potentially leaving incomplete internal data that the engine later mistakes for valid information. The second involves a fatal error that leaves the system pointing to memory that has already been freed, allowing subsequent requests to access or corrupt that space. Because these issues reside in the core PHP engine, websites are vulnerable even if their specific application code is secure. Both vulnerabilities received a critical severity score of 9.2 out of 10.

Attackers can exploit these weaknesses remotely without needing login credentials, potentially executing malicious code and taking control of affected servers. The AI researchers also showed that the flaws could expose sensitive data stored in server memory, including passwords, authentication tokens, and API keys. This level of access makes the vulnerabilities a high-priority target for threat actors, particularly given the ubiquity of PHP across the internet.

In response to the discovery, the PHP Foundation released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the issues. Users of PHP 8.1 and older versions will not receive official fixes and are urged to upgrade. The coordinated release was originally scheduled for October 22 but was brought forward to October 21 following premature disclosures on October 20 that sparked public concern. OpenAI coordinated the effort over a two-month period, attributing the timeline to the complexity of the required changes to the PHP engine.

OpenAI is using this incident to illustrate its Defender's Window concept, a theory introduced after its models hacked Hugging Face. The company describes this as a narrow timeframe where organizations can use frontier AI models to find and patch defenses before malicious actors gain similar capabilities. OpenAI argues that powerful technology will inevitably be used by bad actors, making it a collective responsibility to act proactively. This stance follows recent reports that Anthropic's Claude Mythos identified thousands of zero-day vulnerabilities in major operating systems and web browsers.

The company maintains that the flaws would have persisted for years without AI intervention, as human teams could not fully resolve them. While some argue that the vulnerabilities would not have been exploitable without AI, OpenAI contends that the Defender's Window provides a crucial opportunity for defenders to stay ahead. As the web continues to rely heavily on PHP, the rapid patching of these core engine flaws is seen as a vital step in securing the infrastructure of the modern internet.