AI model finds critical bugs in code running 70 percent of the web

Seventy percent of the internet runs on PHP, and that vast digital footprint just faced a significant security scare. OpenAI announced on October 21 that researchers used its GPT-5.6 Sol model to uncover critical vulnerabilities in the programming language. The discovery highlights the growing role of artificial intelligence in identifying deep-seated software flaws that have eluded human developers for years. For businesses relying on web infrastructure, the news underscores the urgency of updating systems to protect against remote attacks.

The incident stems from the Patch the Planet cybersecurity initiative, a program where AI tools are deployed to find and fix security gaps. Researchers from Calif, a California-based security firm and founding partner of the initiative, began auditing PHP on July 30. They started this work at the specific request of the PHP Foundation. The foundation had been aware of the underlying code issue since 2024 but struggled to find a way to exploit it or a viable fix. This stalemate lasted until August 11, when Calif researcher Ryan A. identified an exploitable path. OpenAI researchers confirmed the finding on the same day. Another firm, Wiz, independently found a related vulnerability shortly after.

The two issues, tracked as CVE-2026-109618 and CVE-2026-109619, involve how PHP manages memory and handles errors. The first flaw occurs when the system runs out of allocated memory during a request. This can leave behind incomplete internal data that the engine later mistakes for valid information. The second issue happens when a fatal error leaves the system pointing to memory that has already been freed. Subsequent requests can then access or corrupt that space. Both flaws carry a critical severity score of 9.2 out of 10. Attackers can exploit these weaknesses remotely without needing login credentials. This allows them to execute malicious code and potentially take control of affected servers.

The implications for data security are severe. AI-assisted researchers demonstrated that these flaws could expose sensitive information stored in server memory. This includes passwords, authentication tokens, and API keys. The vulnerabilities exist in the core PHP engine, meaning even websites with perfectly secure application code are at risk. This distinction is crucial for enterprise security teams, as it shifts the focus from application-level audits to the foundational language itself. The ability to extract such data remotely makes the threat particularly dangerous for e-commerce and financial platforms.

OpenAI attributes the two-month timeline for the fix to the complexity of the required changes. The process involved coordinating a coalition of researchers, PHP maintainers, security providers, and government cybersecurity agencies. Major adjustments to the PHP engine were necessary to resolve the issues properly. The coordinated release of patched versions was originally scheduled for October 22. However, premature disclosures on October 20 caused public outcry, leading the team to bring the release forward to October 21. The PHP Foundation has now released versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the problems. Users of PHP 8.1 and older versions will not receive official fixes.

This event is a practical example of what OpenAI calls the Defender's Window. The company introduced this concept after its models hacked Hugging Face. It describes a narrow timeframe where organizations can use advanced AI models to find and patch defenses before attackers gain similar capabilities. OpenAI argues that powerful technology will inevitably be used by bad actors. Therefore, it is a collective responsibility to act proactively. This perspective challenges the view that flaws are harmless if they are not yet exploitable. The company points to Anthropic's Claude Mythos, which recently identified thousands of zero-day vulnerabilities in major operating systems and browsers, as evidence of this trend.

The speed of the discovery process stands out. Human developers examined the code for two years without fully resolving the flaw. In contrast, AI-wielding researchers demonstrated practical exploitation methods within two weeks. This rapid turnaround suggests that AI tools can accelerate the vulnerability lifecycle significantly. For market leaders, this means the window for security updates is shrinking. Companies must prepare for a future where AI-driven discoveries lead to immediate, coordinated patch releases. The ability to move from discovery to fix in under three months is a new benchmark for the industry.

Looking ahead, the PHP Foundation advises all sites using the language to upgrade to the latest patched versions. OpenAI considers this one of the biggest cybersecurity discoveries of 2026 due to PHP's ubiquity. The incident serves as a warning for other sectors relying on open-source code. As AI models continue to advance, the frequency of such discoveries may increase. Businesses should audit their dependencies and ensure they have processes in place to respond to rapid security updates. The next few months will likely see more reports of AI-assisted vulnerability findings as the Defender's Window concept gains traction.