70% of the Web Just Got a Critical Patch After AI Found a Two-Year-Old Hole

The internet is built on a foundation that has been quietly compromised for two years. While human developers struggled to pinpoint the cause, artificial intelligence models have now identified critical security flaws in PHP, the open-source language that powers an estimated 70% of all websites. The discovery, announced on Oct. 21, reveals that these vulnerabilities could allow attackers to remotely execute malicious code and take control of servers without ever needing a password.

The tension at the heart of this story lies in the speed of modern cybersecurity. For two years, the PHP Foundation knew about an underlying flaw but could not figure out how to exploit it or how to fix it. This stalemate was broken in late July 2026 when researchers from Calif, a founding partner in OpenAI’s “Patch the Planet” initiative, began auditing the language using OpenAI’s GPT-5.6 Sol model. By Aug. 11, the AI-assisted team identified a specific method to turn the dormant bug into a working exploit, a process that took only two weeks after the initial audit began.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are rooted in how PHP manages computer memory and handles errors. The first issue arises when the system runs out of allocated memory, leaving behind incomplete internal data that the engine later mistakes for valid information. The second involves a fatal error that leaves the system pointing to memory that has already been freed. If an attacker can trigger these conditions, they can access or corrupt that memory, potentially exposing sensitive data such as passwords, authentication tokens, and API keys stored on the server.

Because these flaws exist in the core engine of PHP, they affect websites even if the specific application code is perfectly secure. Both bugs received a critical severity score of 9.2 out of 10, indicating a high risk of remote exploitation. In response, the PHP Foundation has released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Users running PHP 8.1 or older versions will not receive official fixes and are advised to upgrade to a supported version to ensure their sites remain secure.

The timeline for these updates was compressed due to a mix of complexity and urgency. OpenAI coordinated a coalition of researchers, maintainers, security providers, and government agencies to address the issues over a two-month period. The coordinated release was originally planned for Oct. 22, but was moved up to Oct. 21 after premature disclosures on Oct. 20 sparked public concern. OpenAI attributes the initial two-month duration to the need for major changes to the PHP engine to properly resolve the memory management issues.

OpenAI is using this incident to illustrate a concept it calls the “Defender’s Window.” Introduced after its models previously hacked Hugging Face, the concept describes a narrow timeframe where organizations can use advanced AI to find and patch defenses before those same capabilities become widely available to malicious actors. The company argues that because powerful technology will inevitably be used by bad actors, there is a collective responsibility to act proactively. This view is supported by recent findings from Anthropic, whose Claude Mythos model identified thousands of zero-day vulnerabilities in major operating systems and browsers.

The discovery highlights a shifting dynamic in software security. Human teams examined the code for two years without finding a practical exploitation path, while AI-wielding researchers demonstrated working exploits within two weeks. Conversely, some argue that the flaws were harmless without AI because they were not easily exploitable by traditional means. Regardless of the debate, the ubiquity of PHP makes this one of the most significant cybersecurity events of 2026, underscoring the growing role of AI in both breaking and securing the digital infrastructure that supports the modern web.