70 Percent of the Web Exposed as AI Solves Two-Year PHP Mystery
An AI-assisted team converted a long-standing PHP memory flaw into a working exploit, forcing a rushed patch release for the language that powers most of the internet.
By Emily Carter ·
A persistent flaw in the PHP programming language, which powers an estimated 70 percent of the web, has been turned into a critical security threat after AI tools enabled researchers to weaponize a bug that had stumped human developers for two years. The discovery has triggered a coordinated patching effort across the industry, with the PHP Foundation releasing urgent updates to protect servers from remote attacks that require no login credentials.
The timeline of the crisis reveals a gap between detection and resolution that spans several years. The PHP Foundation first identified the underlying issue in 2024 but could not determine how to exploit or fix it. On July 30, 2026, researchers from Calif, the founding partner of OpenAI's Patch the Planet initiative, began auditing the code with the company's GPT-5.6 Sol model. By August 11, Calif researcher Ryan A. identified an exploitable vulnerability, a finding quickly corroborated by OpenAI researchers and the independent firm Wiz, which discovered a second related flaw.
The two vulnerabilities, designated CVE-2026-109618 and CVE-2026-109619, score a critical 9.2 out of 10 on the severity scale. They stem from errors in how PHP manages memory and handles fatal errors. In one scenario, the engine may treat incomplete data as valid after running out of memory. In the other, it may point to memory that has already been freed, allowing attackers to access or corrupt it. These weaknesses can expose sensitive data such as passwords and API keys and allow malicious code execution on affected servers.
The complexity of the required fixes involved major changes to the PHP engine, a process that took two months to coordinate among researchers, maintainers, and government agencies. The PHP Foundation originally planned to release patches on October 22, but premature disclosures on October 20 prompted a move to October 21. The updated versions, 8.2.35, 8.3.36, 8.4.27, and 8.5.12, are now available, while versions 8.1 and older will not receive official fixes.
OpenAI frames this incident as a demonstration of the Defender's Window, a concept suggesting that organizations have a narrow timeframe to use advanced AI to secure their defenses before attackers adopt similar capabilities. The company argues that proactive patching is a collective responsibility, noting that human teams failed to resolve the code issues for two years while AI-assisted researchers developed practical exploits in just two weeks. This perspective challenges the view that AI-specific exploits are harmless if they would not exist without AI tools.
The situation highlights the growing role of artificial intelligence in cybersecurity, where the same technology used to find vulnerabilities is increasingly capable of exploiting them. With PHP's ubiquity, the incident is considered one of the most significant cybersecurity discoveries of 2026. The rapid response underscores the need for web developers to upgrade their PHP versions immediately to mitigate the risk of remote server compromise.
As the industry digests the findings, the focus remains on the speed at which AI can transform theoretical bugs into active threats. The coordinated release of patches aims to close the window of vulnerability, but the episode serves as a reminder that the core infrastructure of the web requires constant, sophisticated scrutiny to remain secure against evolving digital attacks.
Source: Tom's Hardware
