OpenAI Credits GPT-5.6 Sol With Exposing Critical PHP Flaws Affecting 70% of Web

The internet’s underlying infrastructure just faced one of its most significant security shocks of 2026, with OpenAI announcing that its GPT-5.6 Sol model helped uncover critical vulnerabilities in PHP, a language that powers an estimated 70% of all websites. The disclosure, made in a press release on Monday, marks a pivotal moment in the debate over AI’s role in cybersecurity, as the company detailed how its tools bridged a gap that human developers could not fill.

According to OpenAI, the flaws were identified by researchers working under the company’s “Patch the Planet” initiative. The process began on July 30, when staff from Calif, a California-based cybersecurity firm and founding partner of the program, started auditing PHP using OpenAI tools at the request of the PHP Foundation. While the Foundation had been aware of the underlying code issue since 2024, they had been unable to determine how to exploit it or how to fix it. That changed on August 11, when Calif researcher Ryan A. identified an exploitable vulnerability, immediately followed by OpenAI researchers confirming the finding on the same day.

The discovery triggered a two-month coordination effort involving PHP maintainers, security providers, and government agencies. The company attributed the timeline to the complexity of the fixes, which required substantial changes to the PHP engine. Patches were originally scheduled for release on Tuesday, but the rollout was pulled forward to Monday following premature disclosures that sparked public concern. The PHP Foundation released updated versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the issues, noting that versions 8.1 and older will not receive official fixes.

The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, both received a critical severity score of 9.2 out of 10. They stem from flaws in how PHP manages memory and handles errors. The first occurs when the engine runs out of allocated memory, potentially leaving behind incomplete data that is later misinterpreted as valid. The second involves a fatal error leaving the engine pointing to already-freed memory, which allows subsequent requests to access or corrupt it. Because these issues reside in PHP’s core engine, they can affect websites even if the application code itself is secure.

Under specific conditions, attackers can exploit these weaknesses remotely without needing login credentials to execute malicious code and potentially take control of servers. The AI-assisted researchers also demonstrated that the flaws could expose sensitive information stored in server memory, including passwords, authentication tokens, and API keys. The speed at which the exploits were developed was notable: while the bug had persisted for two years without a known exploitation method, AI-wielding researchers demonstrated practical exploits within just two weeks.

OpenAI is using this incident to illustrate its “Defender’s Window” concept, a timeframe during which organizations can use frontier AI models to patch defenses before those same capabilities become widely available to malicious actors. The company argues that powerful technology will inevitably be used by bad actors, making proactive fixes a collective responsibility. This view counters the argument that the flaws were effectively harmless because they were not exploitable without AI assistance.

The announcement highlights a broader trend in the tech industry, noting that Anthropic’s Claude Mythos recently identified thousands of zero-day vulnerabilities in major operating systems and web browsers. For site administrators in New York and New Jersey, the immediate takeaway is clear: any site running PHP should upgrade to the latest patched version to ensure security. OpenAI considers this one of the biggest cybersecurity discoveries of the year, given the ubiquity of the language across the global web.