PHP Foundation Issues Emergency Patches for Critical Flaws Aided by OpenAI

Operators of websites running on PHP must install newly released updates to secure their servers against critical memory handling vulnerabilities. The PHP Foundation has pushed out patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address these issues. However, sites running PHP 8.1 or older versions will not receive official fixes. The release of these updates was originally scheduled for October 22, but the timeline was moved up to October 21 after information about the flaws became public on October 20, prompting a strong reaction from the community.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were found within the core engine of the programming language, which underpins an estimated 70% of the internet. The flaws involve how the language manages computer memory and processes errors. Specifically, one issue occurs when the system runs out of allocated memory, potentially leaving behind incomplete data that is later treated as valid. The other involves a fatal error that leaves the system pointing to memory that has already been freed. Under certain conditions, attackers can exploit these weaknesses remotely without needing login credentials to execute malicious code. OpenAI says the flaws could expose sensitive information stored in server memory, including passwords, authentication tokens, and API keys. Both vulnerabilities received a critical severity score of 9.2 out of 10.

The discovery highlights the capabilities of artificial intelligence in cybersecurity research. On October 21, OpenAI announced that researchers working under its Patch the Planet initiative used its AI model, GPT-5.6 Sol, to uncover these flaws. The PHP Foundation had been aware of the underlying issue since 2024 but could not identify a method to exploit or fix it. Human developers and security teams examined the code for two years without fully resolving the flaws. In contrast, researchers utilizing AI tools were able to demonstrate practical ways to exploit the issue within two weeks. The coordinated effort involved a coalition of researchers, PHP maintainers, security providers, and government cybersecurity agencies, a process that took two months due to the complexity of the necessary changes to the PHP engine.

OpenAI attributes the successful remediation to a strategy it calls the Defender's Window. This concept describes a critical, narrow timeframe during which organizations can use advanced artificial intelligence models to find and patch vulnerabilities before those same capabilities become available to malicious actors. The company argues that powerful technology will inevitably be used by bad actors, making it a collective responsibility to act proactively against potential exploitable flaws. This incident is being viewed as an example of that concept in action, coming shortly after Anthropic's Claude Mythos identified thousands of zero-day vulnerabilities in major operating systems and web browsers.