PHP Security: AI Model Sol Exposes Flaws Affecting 70% of Web

OpenAI announced on Tuesday that its GPT-5.6 Sol model helped researchers identify critical memory management flaws in PHP, the open-source language that powers an estimated 70 percent of the internet. The discovery, part of the company's Patch the Planet cybersecurity initiative, led to the rapid release of patched versions for PHP 8.2 through 8.5. The company described the incident as one of the most significant cybersecurity events of 2026 due to the language's widespread use.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, stem from errors in how the PHP engine handles memory allocation and fatal error states. In the first case, the engine may retain incomplete internal data after running out of memory, later mistaking it for valid information. The second flaw leaves the system pointing to memory that has already been freed, allowing subsequent requests to access or corrupt that space. Both issues received a critical severity score of 9.2 out of 10.

Researchers from Calif, a California-based cybersecurity firm and founding partner in the Patch the Planet program, began auditing PHP with OpenAI tools on July 30, 2026. The PHP Foundation had been aware of the underlying issue since 2024 but lacked a method to exploit or fix it. On August 11, a Calif researcher identified the exploitable vulnerability, with OpenAI researchers confirming it the same day. Another firm, Wiz, independently identified an additional related flaw. The two vulnerabilities allow attackers to remotely execute malicious code without login credentials, potentially taking control of affected servers.

The PHP Foundation released fixes for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Older versions, including 8.1, will not receive official updates. The coordinated release was originally planned for Wednesday, October 22, but was moved up to Tuesday, October 21, following premature disclosures on Monday that triggered public concern. OpenAI stated that every site using PHP can now safely upgrade to secure its infrastructure.

OpenAI highlighted the incident as a practical example of its Defender's Window concept. Introduced after its models hacked Hugging Face, this framework describes a narrow timeframe where organizations can use frontier AI to patch defenses before malicious actors gain similar capabilities. The company argues that proactive action is a collective responsibility, noting that Anthropic's Claude Mythos recently identified thousands of zero-day vulnerabilities across major operating systems and browsers.

The timeline of the fix was complex, requiring two months of coordination among researchers, maintainers, and government agencies. OpenAI noted that human developers had examined the code for two years without resolving the flaws, while AI-assisted teams developed working exploits within two weeks. While some may argue the flaws were harmless without AI, OpenAI maintains that powerful technology will inevitably be used by threat actors, making early remediation essential.

The incident underscores the shifting landscape of software security, where AI tools are becoming central to both discovery and defense. As organizations integrate these models into their workflows, the pressure to identify and patch core infrastructure vulnerabilities grows. For New England businesses and developers relying on PHP, the immediate step is to verify their current version and apply the latest patches to maintain resilience.