Patched PHP Flaws Impact Most Web Servers

Website operators and developers must now update their server software immediately to close two critical security gaps that affect the majority of the internet. The PHP Foundation released patched versions of its open-source language on Tuesday, accelerating the rollout by one day due to early public disclosures. Sites running the latest supported versions of the language can now upgrade to secure their infrastructure against remote attacks that do not require login credentials.

OpenAI announced that its GPT-5.6 Sol model, utilized under the Patch the Planet cybersecurity initiative, helped uncover the flaws. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, stem from errors in how PHP manages memory and handles fatal conditions. When the engine runs out of allocated memory or encounters a severe error, it may leave behind incomplete data or point to already freed memory. Attackers can exploit these states to execute malicious code or expose sensitive server data, such as API keys and authentication tokens, potentially taking control of affected websites.

Both issues carry a critical severity rating of 9.2 out of 10. The PHP Foundation has issued fixes for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Users of PHP 8.1 and older versions will not receive official patches for these specific bugs. The coordinated release was originally planned for October 22 but was moved up to October 21 after premature leaks sparked concern in the security community.

The discovery timeline highlights a significant shift in how vulnerabilities are found and fixed. Researchers from Calif, a founding partner in the Patch the Planet program, began auditing the language in late July at the Foundation's request. Although the underlying flaw had been known since 2024, human developers had struggled to identify a practical exploitation method or a fix for two years. Using AI tools, researchers identified a working exploit in just two weeks. Another firm, Wiz, independently discovered a second, related vulnerability during the same period.

OpenAI frames this incident as a demonstration of its "Defender's Window" concept. The company argues that there is a narrow timeframe where organizations can use advanced AI to strengthen defenses before similar capabilities become widely available to attackers. This view follows recent reports that other AI models, such as Anthropic's Claude Mythos, have identified thousands of zero-day vulnerabilities in major operating systems and browsers. OpenAI maintains that proactive remediation is a collective responsibility given the inevitability of AI-driven threats.

The lengthy two-month coordination period for the fix involved a coalition of researchers, maintainers, security providers, and government agencies. OpenAI attributed the delay to the complexity of the task, which required major changes to the PHP engine itself. While some argue the flaws would have remained harmless without AI assistance to exploit them, the incident underscores the growing role of artificial intelligence in both finding and patching critical infrastructure weaknesses.

For ordinary users, the immediate risk is mitigated by these updates, provided their website hosts apply the patches. The incident serves as a reminder that even well-established, widely used programming languages can harbor deep-seated issues that resist traditional human analysis. As AI tools become more prevalent in security audits, the pace of vulnerability discovery and remediation may continue to accelerate, compressing the window for defenders to act.