AI Agents Turn Stagnant PHP Bug Into Critical Threat

A quiet flaw in the PHP engine, known to developers since 2024 but deemed unfixable, suddenly became a ticking time bomb. OpenAI announced on Oct. 21 that its GPT-5.6 Sol model helped researchers transform this dormant bug into working exploits in just two weeks. The discovery forces a difficult question for the industry: when human teams have failed to solve a problem for years, does the arrival of AI turn theoretical weaknesses into immediate, critical threats?

The core tension lies in the speed of modern AI versus the pace of traditional security maintenance. For two years, the PHP Foundation struggled with a vulnerability it could not fully understand or patch. Human developers examined the code but could not identify a reliable method for exploitation or a clean solution. OpenAI argues this gap highlights a critical window where AI can find and fix problems before attackers do, a concept the company calls the Defender's Window.

The technical details reveal a deep-seated issue in how PHP handles memory. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, occur when the language runs out of allocated memory or handles fatal errors incorrectly. In one scenario, incomplete data is left behind and later treated as valid. In the other, the engine points to memory that has already been freed. These flaws allow attackers to potentially execute malicious code remotely without needing login credentials, effectively taking control of affected servers.

The discovery was not a solo effort but a coordinated response involving multiple stakeholders. Researchers from Calif, a founding partner in OpenAI's Patch the Planet initiative, began auditing PHP on July 30, 2026, at the request of the PHP Foundation. On Aug. 11, Calif researcher Ryan A. identified the exploitable vulnerability, and OpenAI researchers confirmed the finding the same day. A third party, Wiz, independently identified an additional related vulnerability. This coalition worked for two months to coordinate a fix, a timeline OpenAI attributes to the complexity of modifying the core PHP engine.

The urgency of the situation became apparent on Oct. 20, when premature disclosures sparked public outcry. Originally scheduled for Oct. 22, the release of patched versions was moved up to Oct. 21. The PHP Foundation issued updates for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Users of PHP 8.1 and older versions were left without official fixes, adding another layer of pressure on site administrators to upgrade their infrastructure.

OpenAI positions this incident as a major cybersecurity milestone for 2026, given that PHP powers an estimated 70% of the internet. The company emphasizes that the flaws exist in the core engine, meaning websites can be vulnerable even if their specific application code is secure. Researchers demonstrated that the bugs could expose sensitive data stored in server memory, including passwords, authentication tokens, and API keys. Both vulnerabilities received a critical severity score of 9.2 out of 10, underscoring the high risk to global web infrastructure.

There is a counter-argument to OpenAI's narrative, however. Some may argue that these flaws were not truly dangerous until AI provided the tools to exploit them, making them effectively harmless prior to this discovery. If human developers could not exploit the bugs, they were not a pressing threat. OpenAI challenges this view by pointing to recent findings by Anthropic's Claude Mythos, which identified thousands of zero-day vulnerabilities in major operating systems and browsers. The company maintains that proactive defense is a collective responsibility, as powerful technology will inevitably be adopted by bad actors.

For users in New York and New Jersey, the immediate action is clear: verify which version of PHP is running on your sites and upgrade to the latest patched version. The incident serves as a reminder that the digital landscape is shifting rapidly. As AI models become more capable, the window for finding and patching vulnerabilities narrows, demanding faster responses from developers and security teams worldwide.