Critical PHP Flaws Fixed After AI-Assisted Discovery Threatens Seven in Ten Websites

The infrastructure underpinning the modern web relies heavily on a specific open-source language, making any instability within its core a matter of global concern. On October 21, OpenAI announced that researchers operating under its Patch the Planet cybersecurity initiative had identified and helped resolve two critical security vulnerabilities in PHP. Given that an estimated 70% of the internet runs on this language, the discovery represents a substantial risk to digital infrastructure worldwide.

The primary claim from OpenAI is that its GPT-5.6 Sol model, working in tandem with human experts, successfully converted a known flaw into a working exploit in just two weeks. This achievement stands in stark contrast to the two years during which human developers knew of the underlying issue but could not determine how to exploit or fix it. The company emphasizes that this speed was crucial, as the vulnerabilities were classified with a critical severity score of 9.2 out of 10.

The technical nature of the flaws involves deep-seated issues in how PHP manages memory and processes errors. Specifically, one vulnerability occurs when the system runs out of allocated memory, potentially leaving incomplete data that the engine later misinterprets as valid. The second involves a fatal error that leaves the system pointing to freed memory, allowing subsequent requests to corrupt or access it. Because these bugs reside in the core engine, they could allow remote attackers to execute malicious code without login credentials, even if the website's application code was otherwise secure.

The resolution process required a coordinated effort involving the PHP Foundation, security providers, and government agencies. Patched versions, including PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, were released on October 21. This date was brought forward by one day from the originally scheduled October 22 release due to premature disclosures on October 20 that triggered public outcry. Older versions, such as PHP 8.1, will not receive official fixes, requiring users to upgrade their systems to ensure safety.

OpenAI frames this incident as a demonstration of the Defender's Window concept, a period during which organizations can use advanced AI to strengthen defenses before those same capabilities become widely available to malicious actors. The company argues that proactive action is a collective responsibility, noting that other AI models have recently identified thousands of zero-day vulnerabilities across major operating systems and browsers. While some may argue that the flaws were only dangerous because AI made them exploitable, OpenAI maintains that the potential for harm necessitated immediate remediation.

The discovery process began in July at the request of the PHP Foundation, with researchers from Calif, a California-based cybersecurity firm and founding partner of the initiative, initiating the audit. On August 11, Calif researcher Ryan A. identified the exploitable vulnerability, which was confirmed by OpenAI researchers the same day. A separate firm, Wiz, independently identified the second vulnerability. Together, these findings have prompted a significant update cycle for web developers and system administrators across the state and beyond.