AI models turn dormant PHP bugs into active threats

The PHP Foundation pulled the release date for its latest security patches forward by a day, moving the rollout from Tuesday, Oct. 22, to Monday, Oct. 21. This acceleration followed premature disclosures on Oct. 20 that sparked public concern. The urgent update addresses two critical vulnerabilities in the open-source language that underpins an estimated 70% of the internet. The fixes are now available in versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, while users on PHP 8.1 or older remain without official support.

OpenAI announced on Oct. 21 that researchers under its “Patch the Planet” initiative used its GPT-5.6 Sol model to identify these flaws. The company coordinated with a coalition of maintainers, security providers, and government agencies to resolve the issues over a two-month period, a timeline it attributed to the complexity of the required engine changes. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, stem from errors in memory management and error handling. Specifically, they allow attackers to remotely execute malicious code on affected servers without needing login credentials, potentially seizing control of websites.

The discovery process began on July 30, when researchers from Calif, a founding partner in the initiative, started auditing PHP at the Foundation’s request. Although the Foundation had been aware of the underlying flaw since 2024, they had been unable to find a way to exploit it or a solution. On Aug. 11, Calif researcher Ryan A. identified the exploitable vulnerability, with OpenAI researchers confirming the finding the same day. Shortly after, the cybersecurity firm Wiz independently discovered a second, related weakness. Both issues carry a critical severity score of 9.2 out of 10.

The core issue lies in how PHP handles memory when it runs out of allocated space or encounters a fatal error. In these scenarios, the engine may mistakenly treat incomplete internal data as valid or point to memory that has already been freed. This allows subsequent requests to access or corrupt that data. Researchers demonstrated that these flaws could expose sensitive information stored in server memory, such as passwords, authentication tokens, and API keys. Crucially, because the bugs exist in the core engine, sites can be affected even if their application code is secure.

OpenAI highlights this incident as a prime example of its “Defender’s Window” concept, a theory introduced after its models hacked Hugging Face. The concept posits a narrow timeframe where organizations can use advanced AI to patch defenses before malicious actors gain similar capabilities. OpenAI argues that human developers had examined the code for two years without success, whereas AI-assisted researchers developed working exploits in just two weeks. The company maintains that proactive action is a collective responsibility, especially as other models, such as Anthropic’s Claude Mythos, have recently identified thousands of zero-day vulnerabilities in major operating systems and browsers.

Skeptics, however, note a different perspective. One could argue that without AI, these specific flaws might never have been turned into practical exploits, rendering them effectively harmless for the two years they persisted. Yet, the sheer scale of PHP’s usage suggests that any remotely exploitable core bug is a significant risk. As the industry grapples with the speed of AI-driven security research, the incident raises questions about whether traditional audit timelines are sufficient to keep pace with new capabilities.