70% of the Web: Why AI Found the PHP Bug Humans Missed for Two Years

If you run a website, or rely on one that handles sensitive data, there is a new reason to check your server logs. The core engine that powers an estimated 70% of the internet, known as PHP, has just been updated to fix two critical security holes. These flaws allow attackers to take control of servers without needing login credentials, a risk that has now been neutralized by new patched versions released this week. For ordinary users, the immediate change is that the platforms they use daily have been hardened against a specific type of remote attack that could have exposed passwords, API keys, and other sensitive data stored in server memory.

The timeline of how these vulnerabilities surfaced is as important as the fix itself. The PHP Foundation first became aware of an underlying issue in 2024, but human developers struggled to figure out how to exploit it or how to fix it. The code sat unresolved for two years. On July 30, 2026, researchers from Calif, a cybersecurity firm, began auditing the language using OpenAI’s GPT-5.6 Sol model as part of a broader initiative. Just eleven days later, on August 11, they identified a method to exploit the flaw. Another firm, Wiz, independently found a second related vulnerability around the same time.

The two bugs, tracked as CVE-2026-109618 and CVE-2026-109619, both stem from how PHP manages memory and handles errors. In the first scenario, if the engine runs out of allocated memory during a request, it can leave behind incomplete internal data. The engine might later mistake this leftover data for valid instructions. The second issue occurs when a fatal error causes PHP to point to memory that has already been freed. Subsequent requests can then access or corrupt that memory. Both flaws carry a severity score of 9.2 out of 10, indicating they are critical risks.

The most concerning aspect is that these vulnerabilities exist in the core engine. This means a website could be vulnerable even if its own application code is perfectly secure. Attackers could execute malicious code remotely, potentially seizing control of the site. The researchers demonstrated that these flaws could also leak sensitive information, such as authentication tokens and passwords, from server memory. This represents a shift in how security threats are perceived, moving from application-level errors to fundamental language-level weaknesses.

OpenAI framed this discovery as a prime example of what it calls the 'Defender's Window.' This concept suggests there is a narrow timeframe where organizations can use advanced AI models to find and patch vulnerabilities before those same AI capabilities become widely available to malicious actors. The company argues that while powerful technology will eventually be used by bad actors, there is a collective responsibility to act proactively. This view contrasts with the idea that flaws requiring AI to exploit are effectively harmless until AI becomes ubiquitous on the attack side.

The release of the fixes was slightly accelerated. The PHP Foundation originally planned to publish the patches on October 22, 2026. However, premature disclosures on October 20 led to public outcry, prompting the team to move the release forward to October 21. The patches are available for PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Users on PHP 8.1 or older versions will not receive official fixes for these specific issues and should consider upgrading to a supported version.

The process of fixing these bugs took two months, a timeline OpenAI attributes to the complexity of the task. Major changes to the PHP engine were required, necessitating coordination among the PHP maintainers, security providers, and government cybersecurity agencies. This collaborative effort highlights the scale of the undertaking, involving a coalition of researchers and institutions to ensure the engine was robustly secured.

For developers and system administrators, the next step is clear: upgrade to the latest patched version. OpenAI states that every site using PHP can now safely upgrade to stay secure. While the bugs had been present for two years, the ability to exploit them was only demonstrated recently. The incident serves as a reminder that the landscape of cybersecurity is shifting rapidly, with AI playing an increasingly central role in both finding and fixing the most difficult code problems.

This event is being viewed by some as one of the significant cybersecurity discoveries of 2026, given the ubiquity of PHP. It underscores the growing interplay between AI development and security infrastructure. As AI models become more capable, the expectation for rapid response to newly discovered flaws may increase, forcing the software industry to adapt its maintenance and patching strategies to keep pace with automated discovery tools.