OpenAI claims AI model Sol found critical PHP flaws that stumped human coders for years

A pair of deep-seated bugs in one of the world’s most common web technologies has been fixed, but only after artificial intelligence stepped in to crack a problem that had eluded human experts for two years.

OpenAI announced on October 21 that its GPT-5.6 Sol model helped uncover two critical vulnerabilities in PHP, the open-source language that powers an estimated 70 percent of the internet. The discovery was made by researchers working under the company’s “Patch the Planet” cybersecurity initiative. Because PHP is so widely used, OpenAI considers this one of the most significant security findings of 2026. The company says it worked with a coalition of researchers, maintainers, and government agencies to develop fixes over a two-month period, a timeline it attributes to the complexity of the changes required in the PHP engine.

The flaws were tracked as CVE-2026-109618 and CVE-2026-109619 and involve how PHP manages computer memory and handles errors. The first issue arises when PHP runs out of allocated memory during a request, potentially leaving behind incomplete data that the engine later misinterprets as valid. The second involves a fatal error that leaves PHP pointing to memory that has already been freed, allowing subsequent requests to access or corrupt that space. Under specific conditions, attackers can exploit these weaknesses remotely without needing login credentials, potentially executing malicious code and taking control of affected servers.

The timeline of the discovery highlights the speed of AI-assisted auditing. Researchers from Calif, a California-based cybersecurity firm and founding partner of the Patch the Planet program, began auditing PHP with OpenAI tools on July 30, 2026, at the request of the PHP Foundation. Although the Foundation had been aware of the underlying flaw since 2024, they could not identify a way to exploit it or a fix. On August 11, Calif researcher Ryan A. identified the exploitable vulnerability, and OpenAI researchers confirmed it that same day. Independently, the cybersecurity firm Wiz also identified an additional vulnerability during this period.

The PHP Foundation has released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address these issues. Versions 8.1 and older will not receive official fixes. While the coordinated release was originally scheduled for October 22, it was brought forward to October 21 after premature disclosures on October 20 sparked public concern. OpenAI advises that any site using PHP can now safely upgrade to remain secure, noting that the vulnerabilities exist in the core engine, meaning sites can be affected even if their specific application code contains no security flaws.

Both vulnerabilities were assigned a critical severity score of 9.2 out of 10. The AI-assisted researchers also demonstrated that these flaws could expose sensitive information stored in server memory, such as passwords, authentication tokens, and API keys. This capability to access underlying data without a direct code flaw in the application layer makes the bugs particularly dangerous for website administrators who may have believed their code was secure.

OpenAI argues that this incident exemplifies what it calls the “Defender’s Window.” The company introduced this concept after its models hacked Hugging Face, describing it as a narrow timeframe during which organizations can use advanced AI models to find and patch defenses before malicious threat actors gain access to similar capabilities. OpenAI states that human developers had examined the code but failed to resolve the issues, allowing them to persist for two years. In contrast, AI-wielding researchers demonstrated practical exploitation methods within two weeks. While some might argue the flaws were harmless without AI, OpenAI maintains that proactive action is a collective responsibility to address potential exploits before they are weaponized.

This event follows a similar finding by Anthropic, whose Claude Mythos model recently identified thousands of zero-day vulnerabilities in major operating systems and web browsers. As AI tools become more capable of auditing complex codebases, the pressure on developers and organizations to upgrade their infrastructure increases. For the Pacific Northwest tech community, which hosts numerous cloud and e-commerce businesses, this update serves as a reminder that the foundational layers of the web are under increasingly sophisticated scrutiny.