OpenAI Says ChatGPT Sol Helped Uncover Critical PHP Flaws
Researchers utilized OpenAI tools to discover severe PHP vulnerabilities affecting a language that powers an estimated 70% of the internet.
Radwan AbdulhadiEditor and technology writer
Uncovering Critical PHP Vulnerabilities with AI
OpenAI announced in a press release on Oct. 21 that researchers participating in its “Patch the Planet” cybersecurity initiative successfully utilized its AI model GPT-5.6 Sol to identify critical security vulnerabilities in PHP, an open-source programming language that runs an estimated 70% of the internet. Detailed information regarding the disclosure can be found in the official <a href="https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/">press release</a>.
Following the discovery, OpenAI stated that it coordinated a coalition consisting of researchers, PHP maintainers, security providers, and government cybersecurity agencies to resolve the issues over a two-month period. The lengthy timeline was attributed to the high complexity of the task, which required substantial changes to the core PHP engine.
Patching and Coordinated Disclosures
The PHP Foundation subsequently released patched versions including PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the vulnerabilities. However, PHP 8.1 and older versions will not receive official fixes. The coordinated release was initially scheduled for Oct. 22, but was brought forward to Oct. 21 following premature disclosures on Oct. 20 that caused a public outcry.
OpenAI noted that every site using PHP can now safely upgrade its version to maintain security. The event is regarded by the company as one of the most significant cybersecurity discoveries of 2026 due to PHP's widespread ubiquity across the web.
Origins and Investigation Timeline
Operating under the Patch the Planet program, researchers from Calif—a California-based cybersecurity firm and founding partner of the program—began auditing PHP using OpenAI tools on July 30, 2026, at the request of the PHP Foundation. Although the Foundation had known about the underlying flaw since 2024, it was unable to identify a fix or an exploitation method. Calif researcher Ryan A. first identified the exploitable vulnerability on Aug. 11, with OpenAI researchers making the same identification that day. Another cybersecurity firm, Wiz, subsequently identified an additional vulnerability independently.
Additional context and reporting on these developments are continuously updated by media outlets such as <a href="https://www.tomshardware.com/tech-industry/cyber-security/openai-says-gpt-5-6-sol-helped-uncover-critical-php-flaws-that-could-affect-70-percent-of-websites-ai-assisted-researchers-turned-two-year-old-bug-that-stumped-human-developers-into-working-exploits-in-two-weeks">Tom's Hardware</a>, tracking how AI-assisted workflows accelerate technical research.
Technical Details of the Vulnerabilities
The two vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, involving flaws in how PHP manages computer memory and handles errors. The first occurs when PHP runs out of allocated memory during request processing, leaving incomplete internal data that the engine might mistakenly treat as valid later. The second involves a related issue where a fatal error leaves PHP pointing to memory that has already been freed, allowing subsequent requests to access or corrupt it.
Under specific conditions, attackers can exploit these weaknesses remotely without needing login credentials to execute malicious code on servers and potentially take control of websites. Researchers also demonstrated that the flaws could expose sensitive information stored in server memory, including passwords, authentication tokens, and API keys. Because these vulnerabilities exist in PHP's core engine, websites can be affected even if their application code contains no security flaws. Both vulnerabilities received a critical severity score of 9.2 out of 10.
The Defender's Window Concept
Human developers and security teams had previously examined the underlying code without managing to fully resolve the flaws, allowing them to persist for two years after discovery. In contrast, AI-wielding researchers demonstrated practical exploitation methods within two weeks.
OpenAI highlights this situation as an illustration of the Defender's Window concept, which describes a narrow timeframe during which organizations can use frontier AI models to find and patch vulnerabilities before malicious threat actors gain access to similar capabilities. Readers looking for updates or looking to follow ongoing reporting can <a href="https://google.com/preferences/source?q=tomshardware.com">Follow us</a> on preferred news platforms to stay informed on AI and cybersecurity developments.
Sources
- Tom's HardwareOpenAI says ChatGPT Sol helped uncover critical PHP flaws that could affect 70% of websites
Continue chronologically
Related entity coverage
Related stories
How AI Tools Helped Uncover Years-Old PHP Vulnerabilities
Security researchers used frontier artificial intelligence tools to expose long-standing flaws in the PHP scripting language, triggering rapid attacks.
Hackers Had Four-Day Head Start on Epic PHP2Shell Flaw
Amazon reveals hackers probed the critical PHP2Shell security vulnerability four days before public disclosure, triggering a global patch rush.
PHP Critical Bugs Threaten Internet Stability
Critical vulnerabilities in the widely used PHP programming language threaten global web infrastructure as security researchers race to patch systems.
Cloudflare Deploys WAF Protections for php2shell Vulnerabilities
Cloudflare has automatically deployed default WAF rules to protect web applications against newly disclosed php2shell vulnerabilities in PHP.
