OpenAI Reports AI Model Sol Uncovers Critical PHP Vulnerabilities Affecting Websites
Security flaws in the PHP engine, which run a vast portion of the internet, were identified and patched through an AI-assisted security initiative.
By Ama Boateng ·
OpenAI announced on October 21 that its GPT-5.6 Sol model was used to uncover critical security vulnerabilities in PHP, a programming language that powers an estimated 70% of websites. The discovery was made through the company's Patch the Planet cybersecurity program, which led to a two-month coordination effort involving researchers, PHP maintainers, and government agencies to resolve the issues. OpenAI attributed the lengthy timeline to the task's complexity, which required major changes to the PHP engine.
Following the discovery, the PHP Foundation released patched versions of the language. The updates, 8.2.35, 8.3.36, 8.4.27, and 8.5.12, address the vulnerabilities in their respective branches. Older versions, specifically PHP 8.1 and earlier, will not receive official fixes. The coordinated release was initially scheduled for October 22 but was advanced to October 21 after details about the flaws were prematurely disclosed on October 20, prompting public concern.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, involve flaws in PHP's memory management and error handling. Under specific conditions, these weaknesses could allow attackers to remotely execute malicious code on affected servers without needing login credentials, potentially leading to website takeovers. The flaws can also expose sensitive information stored in server memory, including passwords, authentication tokens, and API keys. Both vulnerabilities were given a critical severity score of 9.2 out of 10.
The audit of PHP was initiated on July 30 by researchers from Calif, a cybersecurity firm and founding partner of the Patch the Planet program, at the request of the PHP Foundation. The Foundation had been aware of an underlying flaw since 2024 but had been unable to identify a method to exploit it or a way to fix it. A researcher from Calif first identified an exploitable vulnerability on August 11, followed by OpenAI researchers the same day. Another cybersecurity firm, Wiz, later independently identified a second vulnerability.
Human developers and security teams had examined the code related to the flaw but could not fully resolve it, allowing it to persist for two years after its discovery. In contrast, researchers working with AI tools demonstrated practical ways to exploit the issue within two weeks. OpenAI highlighted the incident as an example of its Defender's Window concept, which describes a limited timeframe where organizations can use advanced AI models to find and fix vulnerabilities before those same capabilities become available to malicious actors.
The company considers the discovery one of the biggest cybersecurity events of 2026, given PHP's wide use across the internet. OpenAI argues that powerful technology will inevitably be used by bad actors, and it is a collective responsibility to proactively address any potential exploitable flaws. The company's position follows a recent report from Anthropic's Claude Mythos, which identified thousands of zero-day vulnerabilities in every major operating system and every major web browser.
Source: Tom's Hardware
