Fixes for Flaws in the Code Behind Most Websites

Security experts are urging websites that use PHP to update their software right away. The call comes after two serious security flaws were found in the code that powers an estimated 70% of the internet. OpenAI announced the discovery in a press release on Oct. 21. The company said researchers used its AI model, GPT-5.6 Sol, to uncover the critical vulnerabilities. The flaws, rated a critical 9.2 out of 10, could let attackers take control of websites. The PHP Foundation has released patched versions to fix the issues.

Here is a timeline of how this came about. The PHP Foundation knew about an underlying flaw in PHP's engine since 2024. However, it could not find a way to exploit it or a way to fix it. On July 30, 2026, researchers from a cybersecurity firm began a security audit of PHP using OpenAI's tools. This was done at the request of the PHP Foundation. The first exploitable vulnerability was identified on Aug. 11. Another cybersecurity firm later found a second, related issue. The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619. They involve how PHP manages computer memory and handles errors.

Under certain conditions, an attacker could use these flaws to run malicious code on a server without needing a password. This could allow them to take control of a website. The AI-aided researchers also showed that the flaws could expose sensitive information stored in server memory. This includes passwords, authentication tokens, and API keys. The flaws are in PHP's core engine, which means websites are at risk even if their own application code is secure. The PHP Foundation has released patched versions of PHP 8.2, 8.3, 8.4, and 8.5 to address the vulnerabilities. Older versions, PHP 8.1 and earlier, will not receive official fixes.

The coordinated release of these fixes was originally planned for Oct. 22. It was moved up to Oct. 21 after information about the flaws was disclosed prematurely on Oct. 20. OpenAI says human developers examined the code for two years but could not resolve the flaws. In contrast, researchers using AI demonstrated ways to exploit the flaws within two weeks. OpenAI views this as a major cybersecurity discovery of 2026 because of PHP's widespread use. The company highlights the incident as an example of the 'Defender's Window' concept. This idea describes a short period where organizations can use advanced AI to find and fix security flaws before attackers can do the same.

What is next? The company advises every site using PHP to upgrade its version to stay secure. OpenAI says it is a collective responsibility to act proactively to fix potential security flaws. The company argues that powerful technology will eventually be used by bad actors. This is why it is important to patch vulnerabilities as soon as they are found.