Critical PHP Flaws: Patch Released After AI-Assisted Discovery

Patches for critical security flaws in PHP, a programming language that runs an estimated 70% of the internet, were released on October 21, bringing to a close a two-month remediation effort. The flaws in the open-source language were uncovered through an initiative that uses artificial intelligence to strengthen cybersecurity defenses. The coordinated release was moved up from its original October 22 date after some details about the vulnerabilities became public on October 20, which prompted a public reaction.

The PHP Foundation has issued updated versions, including PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, to address the identified vulnerabilities. Websites that use PHP are advised to upgrade to these patched versions to maintain security. However, official fixes will not be provided for PHP 8.1 and older releases. The vulnerabilities, which received a critical severity rating of 9.2 out of 10, involve issues with how PHP handles computer memory and errors. Under specific conditions, these weaknesses could be exploited remotely to execute malicious code on a server, potentially allowing for website takeover. The flaws could also expose sensitive information stored in server memory, such as passwords, authentication tokens, and API keys.

The discovery was made under the Patch the Planet program, which was initiated to use advanced artificial intelligence models for defensive security measures. The process began on July 30, 2026, when a California-based cybersecurity firm started auditing PHP at the request of the PHP Foundation. Researchers from the firm and OpenAI identified the exploitable vulnerabilities on August 11, 2026. Another cybersecurity firm, Wiz, later identified an additional vulnerability. The two primary flaws are tracked as CVE-2026-109618 and CVE-2026-109619.

The underlying defect that led to these vulnerabilities was first discovered in 2024, but human developers were unable to identify an exploitation method or create a fix for the complex issue. The PHP Foundation had known about the flaw but could not resolve it. In contrast, researchers using artificial intelligence tools identified a method to exploit the flaw within two weeks, demonstrating that the vulnerabilities in PHP's core engine could be used to attack servers. This means websites could be affected even if their own application code contains no security flaws.

The incident is being cited as an example of a concept called the Defender's Window. This idea, introduced by OpenAI, describes a critical, narrow timeframe in which organizations can use advanced artificial intelligence models to find and patch cybersecurity flaws before those same capabilities become available to malicious actors. OpenAI considers this one of the biggest cybersecurity discoveries of 2026, given how widely PHP is used.