AI-Driven Research Uncovers Critical Flaws in Software Powering 70% of Websites

Patch updates were released for PHP, the open-source programming language that underpins an estimated 70% of websites, to address critical security vulnerabilities identified with the assistance of artificial intelligence. The PHP Foundation published the patched versions on October 21, one day ahead of schedule, following disclosures on October 20 that prompted public concern over the timeline.

The coordinated release includes updates for PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Sites running PHP 8.1 or older versions will not receive official fixes for these issues. OpenAI has advised that every site using PHP should upgrade to the latest version of their branch to ensure security.

The flaws were uncovered by researchers participating in the Patch the Planet program. This initiative, whose founding partner is the California-based cybersecurity firm Calif, began auditing PHP on July 30 at the request of the PHP Foundation. Although the Foundation had been aware of an underlying flaw in the code since 2024, they had been unable to determine a method of exploitation or a solution.

Assisted by AI models, researchers identified an exploitable vulnerability on August 11, a date on which both a Calif researcher and OpenAI researchers made the discovery. Subsequently, the cybersecurity firm Wiz independently identified an additional vulnerability.

The two vulnerabilities, designated as CVE-2026-109618 and CVE-2026-109619, both concern the management of memory and the handling of errors within the language. One issue occurs when the system exhausts its allocated memory during a request, potentially leaving behind incomplete data that is later treated as valid. The other involves a scenario where a fatal error causes the system to point to memory that has already been freed, which can then be accessed or corrupted by subsequent requests.

Under specific conditions, these weaknesses may permit attackers to execute malicious code remotely on affected servers without the need for login credentials, potentially enabling the takeover of websites. Additionally, researchers demonstrated that the flaws could expose sensitive information stored in server memory, including passwords, authentication tokens, and API keys. Both vulnerabilities have been assigned a critical severity score of 9.2 out of 10.

The discovery process highlighted a significant disparity in the timeline required to address the issues. Human developers and security teams examined the underlying code but were unable to fully resolve the flaws, which persisted for two years following their initial discovery. In contrast, researchers utilizing AI tools demonstrated practical methods for exploiting the vulnerability within two weeks.

OpenAI has attributed the two-month timeline required to patch the issues to the complexity of the task, which necessitated major changes to the PHP engine. The company considers this incident one of the most significant cybersecurity discoveries of 2026, given the widespread use of PHP, and cites it as an example of the Defender's Window concept in action.

This concept, which OpenAI introduced after its models hacked Hugging Face, describes a critical and narrow timeframe during which organizations can utilize advanced AI models to find and patch cybersecurity defenses before those same capabilities become available to malicious actors. OpenAI maintains that powerful technology will inevitably be used by bad actors and that it is a collective responsibility to act proactively to address potential exploitable flaws. This follows a recent statement from Anthropic's Claude Mythos, which identified 'thousands of zero-day vulnerabilities' in 'every major operating system and every major web browser.'