OpenAI and PHP Foundation Accelerate Patches for Critical Engine Flaws Affecting Majority of Web Traffic

The PHP Foundation moved the public release of critical security patches forward to October 21, 2026, following premature disclosures that triggered immediate market and developer reaction. The updates, designated as versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, address two severe vulnerabilities in the core engine of PHP, the open-source language estimated to underpin 70% of global web content. This accelerated timeline was necessitated by the rapid identification of exploitable methods for flaws that had previously stumped human developers for two years.

The discovery was driven by OpenAI’s “Patch the Planet” cybersecurity initiative, which utilized its GPT-5.6 Sol model to audit the codebase. The initiative began on July 30, 2026, at the request of the PHP Foundation, with support from founding partner Calif, a California-based cybersecurity firm. While the Foundation had been aware of the underlying defect since 2024, it lacked a clear path to resolution. The AI-assisted team, including Calif researcher Ryan A., identified the first exploitable vulnerability on August 11, 2026. On the same day, OpenAI’s internal researchers confirmed the finding. Shortly thereafter, independent security firm Wiz identified a second, related flaw.

The two issues, tracked as CVE-2026-109618 and CVE-2026-109619, carry a critical severity score of 9.2 out of 10 and stem from errors in memory management and error handling. The first flaw occurs when PHP exhausts its allocated memory during a request, potentially leaving behind incomplete data that the engine later misidentifies as valid. The second involves a fatal error that leaves the system pointing to already-freed memory, allowing subsequent requests to access or corrupt that space. Because these bugs reside in the core engine, they affect websites even if the specific application code is secure.

Attackers can exploit these weaknesses remotely without login credentials to execute malicious code on affected servers. Furthermore, the flaws can expose sensitive data stored in server memory, including passwords, authentication tokens, and API keys. OpenAI coordinated a coalition of PHP maintainers, security providers, and government agencies to develop fixes over a two-month period. The company noted that the complexity of the task required significant changes to the PHP engine, contributing to the length of the remediation process. Sites using PHP 8.1 or older versions will not receive official fixes and are advised to upgrade to the latest supported versions.

OpenAI frames this incident as a key example of the “Defender’s Window,” a concept the company introduced after its models previously targeted Hugging Face. This term describes a narrow timeframe during which organizations can leverage advanced AI to find and patch vulnerabilities before those same capabilities become widely available to malicious actors. The company argues that while human teams could not fully resolve the flaws for two years, AI-wielding researchers demonstrated practical exploits in just two weeks. OpenAI maintains that proactive defense is a collective responsibility, especially as tools like Anthropic’s Claude Mythos have recently identified thousands of zero-day vulnerabilities in major operating systems and browsers.

For the broader tech market, the event underscores the shifting dynamics of cybersecurity economics. The ability of AI to rapidly convert theoretical bugs into active threats compresses the window for manual patching. As a result, infrastructure providers and web developers must now factor in faster response times and potentially higher costs for maintaining legacy systems. The incident highlights that the most significant risks are no longer limited to application-level errors but extend to the foundational software layers that support the majority of the web.