OpenAI Sol AI Finds Critical PHP Flaws Affecting 70% of Web

OpenAI revealed on Oct. 21 that its GPT-5.6 Sol model helped uncover severe security holes in PHP, the open-source language powering an estimated 70% of the internet. The discovery occurred under the company's Patch the Planet cybersecurity initiative. Following the find, OpenAI coordinated a group of researchers, maintainers, and government agencies to develop fixes. The company noted the two-month timeline was necessary due to the complexity of the changes required in the PHP engine.

The PHP Foundation has now released updated versions, including PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Older versions, specifically 8.1 and prior, will not receive official patches. The coordinated release was originally planned for Oct. 22, but developers moved the date to Oct. 21. This shift happened after premature disclosures on Oct. 20 caused public concern.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, stem from flaws in how PHP manages memory and errors. The first issue arises when the system runs out of memory during a request, potentially leaving incomplete data behind. The second involves a fatal error that leaves the system pointing to already freed memory. Attackers can exploit these remotely without login credentials to run malicious code on servers.

Researchers from Calif, a founding partner of the initiative, began the audit on July 30, 2026. The PHP Foundation had known about the underlying flaw since 2024 but could not determine how to exploit or fix it. Calif researcher Ryan A. identified the exploitable vulnerability on Aug. 11. OpenAI researchers confirmed it the same day. Another firm, Wiz, independently found an additional weakness. Both flaws carry a critical severity score of 9.2 out of 10.

OpenAI argues this incident exemplifies its Defender's Window concept. This term describes a narrow period where organizations can use advanced AI to find and patch defenses before attackers do. Human teams struggled with the code for two years. AI-assisted researchers, however, created working exploits in just two weeks. The company suggests this proves the need for proactive security measures using new tools.

The company believes powerful technology will inevitably be used by bad actors. It therefore views addressing potential flaws as a collective responsibility. This stance follows a recent report by Anthropic, which stated its Claude Mythos model found thousands of zero-day vulnerabilities in major operating systems and browsers. OpenAI considers this PHP discovery one of the most significant cybersecurity events of 2026 due to the language's widespread use.