AI Finds Flaws in Core Web Engine

A major security shakeup has hit the internet’s backbone, with critical flaws found in the software that powers three-quarters of all websites. OpenAI revealed on Tuesday that its GPT-5.6 Sol model played a key role in identifying these vulnerabilities, which had eluded human developers for two years. The discovery has triggered a coordinated effort to patch the system before attackers can fully exploit the weaknesses.

The issues, tracked as CVE-2026-109618 and CVE-2026-109619, stem from how PHP manages memory and handles errors. When the system runs out of memory or encounters a fatal error, it can leave behind incomplete data or point to freed memory. Under specific conditions, remote attackers can use these glitches to execute malicious code without needing login credentials, potentially taking control of servers. Both flaws carry a critical severity score of 9.2 out of 10, and they affect the core engine itself, meaning even well-coded applications are at risk.

The timeline of this discovery highlights the shifting dynamics of cybersecurity. The PHP Foundation first noticed the underlying flaw in 2024 but could not find a way to exploit or fix it. In late July, researchers from Calif, a founding partner in OpenAI’s Patch the Planet initiative, began auditing the code. By August 11, Calif researcher Ryan A. and OpenAI’s team identified the exploitable vulnerability. Within two weeks, they had practical methods for exploiting the bug, a pace that human teams had failed to match over the previous two years. Another firm, Wiz, also independently found a related vulnerability during this period.

The PHP Foundation has released updated versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the issues. Older versions, specifically 8.1 and below, will not receive official fixes, urging users to upgrade. The release was originally planned for today but was moved up to yesterday after premature disclosures on October 20 caused public concern. OpenAI notes that while the bugs existed for a long time, AI made them effectively dangerous by providing the means to exploit them.

OpenAI frames this event as a prime example of the "Defender's Window." This concept suggests there is a narrow period where advanced AI can be used to find and patch flaws before they become widely available to malicious actors. The company argues that powerful technology will inevitably be used by bad actors, making proactive defense a collective responsibility. This view follows recent reports that Anthropic’s Claude Mythos model identified thousands of zero-day vulnerabilities in major operating systems and browsers.

Moving forward, website administrators are advised to upgrade to the latest patched versions immediately. While some argue the flaws would have remained harmless without AI to exploit them, OpenAI maintains that the rapid progress in AI-driven security research demands a proactive approach. The incident serves as a stark reminder that the landscape of web security is changing faster than traditional development cycles can keep up with.