OpenAI claims AI model Sol exposed deep flaws in PHP affecting most of the web
A two-year-old memory error in PHP was turned into a working exploit by AI-assisted researchers, prompting urgent patches for a language that powers a vast portion of the internet.
By Mei Ling ·
A long-standing weakness in one of the world's most popular web programming languages has finally been exposed, revealing how artificial intelligence is reshaping the landscape of cybersecurity. OpenAI announced on October 21 that its GPT-5.6 Sol model helped researchers identify critical vulnerabilities in PHP, the open-source language that runs an estimated 70 percent of the internet. The discovery highlights a growing tension between the speed at which AI can find bugs and the time human developers need to fix them, a gap that could leave millions of websites at risk.
The core of the conflict lies in the age of the flaw. The PHP Foundation had been aware of the underlying issue since 2024, but human teams could not determine how to exploit it or how to correct it. For two years, the bug remained a theoretical concern. However, researchers from Calif, a California-based cybersecurity firm and founding partner in OpenAI's Patch the Planet initiative, used AI tools to identify an exploitable method just two weeks after beginning their audit in late July. This rapid progression from known flaw to active threat underscores the changing dynamics of software security.
Two specific vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, stem from errors in how PHP manages memory and handles fatal errors. The first flaw occurs when the engine runs out of allocated memory during a request, potentially leaving behind incomplete data that is later treated as valid. The second involves a fatal error that leaves the system pointing to memory that has already been freed. Both issues allow attackers to remotely execute malicious code on affected servers without needing login credentials, potentially giving them full control over a website.
The severity of these bugs is compounded by their location within PHP's core engine. Because the flaws exist in the foundational code, websites can be vulnerable even if their own application code is secure. AI-assisted researchers demonstrated that these weaknesses could also expose sensitive information stored in server memory, such as passwords, authentication tokens, and API keys. Both vulnerabilities received a critical severity score of 9.2 out of 10, reflecting the high level of danger they pose to web infrastructure.
In response to the findings, the PHP Foundation released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. These updates were coordinated with a coalition of researchers, security providers, and government agencies. The release was originally scheduled for October 22 but was moved up to October 21 after premature disclosures on October 20 caused public concern. Versions of PHP prior to 8.1 will not receive official fixes, meaning older systems remain exposed to the vulnerabilities.
OpenAI frames this incident as a prime example of its Defender's Window concept. This theory suggests there is a narrow period during which organizations can use advanced AI models to strengthen their defenses before those same capabilities are widely adopted by malicious actors. The company argues that if powerful AI can find these bugs, bad actors will eventually find them too. Therefore, proactive patching is a collective responsibility to secure the digital infrastructure before the window of advantage closes.
The broader context includes recent reports from other AI developers, such as Anthropic, whose models have identified thousands of zero-day vulnerabilities in major operating systems and web browsers. OpenAI maintains that while some argue these flaws might have remained harmless without AI, the practical ability to exploit them changes the risk calculus. As AI tools become more integrated into security research, the pace of discovery and remediation is expected to accelerate, placing new demands on the software maintenance community.
Looking ahead, the industry must adapt to a new reality where AI-driven discovery is the norm. The PHP incident serves as a cautionary tale for other widely used technologies that may harbor similar deep-seated issues. For New England businesses and developers relying on PHP, the immediate action is clear: upgrade to the latest patched versions. The episode reinforces the idea that cybersecurity is no longer just a human endeavor but a collaborative effort between human expertise and machine intelligence.
Source: Tom's Hardware
