AI Finds Major Web Security Gaps That Humans Missed

The web runs on a foundation of code that many people never see, but a recent discovery suggests that foundation had a significant crack in it for the last two years. On Tuesday, OpenAI announced that its AI model, GPT-5.6 Sol, helped researchers uncover critical security vulnerabilities in PHP, the open-source programming language that powers an estimated 70% of the internet.

The findings are part of OpenAI's 'Patch the Planet' cybersecurity initiative. According to the company, the discovery was not made in isolation. Instead, a coalition of researchers, PHP maintainers, security providers, and government cybersecurity agencies worked together for two months to coordinate the fix. OpenAI noted that the process was complex, requiring major changes to the underlying PHP engine, which explains why the resolution took so long.

The PHP Foundation has already released updated versions to address the issues, specifically PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Sites running these versions are now considered secure. However, older versions, including PHP 8.1 and anything prior, will not receive official patches. The coordinated release of these fixes was originally planned for Wednesday, October 22, but was moved up to Tuesday, October 21, after premature details leaked on October 20, sparking public concern.

The investigation began on July 30, when researchers from Calif, a California-based cybersecurity firm and founding partner of the Patch the Planet program, started auditing PHP at the request of the PHP Foundation. The Foundation had actually known about the underlying flaw since 2024 but could not figure out how to exploit it or how to fix it. On August 11, Calif researcher Ryan A. identified an exploitable vulnerability, and OpenAI researchers found issues the same day. Another firm, Wiz, independently discovered a second vulnerability shortly after.

These two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, stem from how PHP manages computer memory and handles errors. The first issue occurs when PHP runs out of allocated memory, potentially leaving behind incomplete data that the engine later treats as valid. The second involves a fatal error that leaves the system pointing to memory that has already been freed, allowing subsequent requests to access or corrupt it.

The practical implication is serious. Attackers could potentially exploit these weaknesses remotely without needing login credentials to execute malicious code on affected servers, effectively taking control of websites. The AI-assisted researchers also demonstrated that these flaws could expose sensitive information stored in server memory, such as passwords, authentication tokens, and API keys. Both vulnerabilities carry a critical severity score of 9.2 out of 10.

This incident highlights a concept OpenAI calls the 'Defender's Window.' The company argues that there is a narrow timeframe where organizations can use advanced AI models to find and patch defenses before those same capabilities become widely available to bad actors. While human developers had examined the code for two years without success, AI-wielding researchers turned the bug into a working exploit in just two weeks. OpenAI believes this proactive approach is a collective responsibility, especially as other AI models continue to identify zero-day vulnerabilities across major operating systems and browsers.