Patched PHP releases address critical flaws in 70% of the web

Website owners and developers in the Mid-Atlantic and beyond face an immediate action item: upgrading their server software to the latest version. The PHP Foundation has issued emergency patches for four major versions of the programming language, which powers an estimated 70% of the internet. These updates, released on Wednesday, address two critical security holes that allow attackers to take control of servers without needing login credentials. Sites running PHP 8.1 or older remain unsupported by the new fixes, requiring manual intervention or migration to stay safe.

OpenAI announced on October 21 that its “Patch the Planet” initiative uncovered these vulnerabilities using its GPT-5.6 Sol model. The discovery was coordinated by a coalition including PHP maintainers, security providers, and government agencies. The company noted that the remediation process took two months due to the complexity of the required changes to the PHP engine. Although the coordinated release was originally scheduled for Thursday, it was moved up to Wednesday after premature disclosures on Tuesday sparked public concern.

The core issue lies in how PHP manages memory and handles errors. The first flaw, tracked as CVE-2026-109618, occurs when the system runs out of allocated memory during a request. This can leave behind incomplete internal data that the engine later mistakenly treats as valid. The second flaw, CVE-2026-109619, involves a fatal error that leaves the system pointing to memory that has already been freed. This allows subsequent requests to access or corrupt that memory. Both vulnerabilities carry a critical severity score of 9.2 out of 10.

Researchers from Calif, a California-based cybersecurity firm and founding partner of the Patch the Planet program, began auditing PHP on July 30 at the Foundation's request. The Foundation had been aware of the underlying flaw since 2024 but could not identify a method to exploit or fix it. On August 11, Calif researcher Ryan A. identified an exploitable version of the bug, with OpenAI researchers confirming the finding the same day. A separate firm, Wiz, independently discovered the additional vulnerability during this period.

The use of artificial intelligence allowed researchers to demonstrate practical exploitation methods within two weeks of identification. This stands in contrast to the two years human developers spent examining the code without a full resolution. OpenAI describes this timeline as a demonstration of its “Defender's Window” concept. The company argues that there is a narrow timeframe where organizations can use advanced AI to strengthen defenses before malicious actors gain widespread access to similar tools.

The vulnerabilities are significant because they exist in the core PHP engine. This means that even websites with perfectly secure application code can be compromised if they run an unpatched version of the language. Attackers can exploit these weaknesses remotely to execute malicious code, potentially leading to full control of a website. The flaws also allow for the exposure of sensitive data stored in server memory, including passwords, authentication tokens, and API keys.

OpenAI highlighted this incident as one of the most significant cybersecurity discoveries of 2026 due to PHP’s widespread use. The company contends that powerful technology will inevitably be used by bad actors, making proactive fixes a collective responsibility. This perspective challenges the view that flaws requiring AI to exploit are effectively harmless. Anthropic’s Claude Mythos recently identified thousands of zero-day vulnerabilities in major operating systems and browsers, reinforcing the urgency of this defensive posture.

For users in the region, the practical impact is clear. If your website or application runs on PHP, you should verify your version immediately. If you are on 8.2, 8.3, 8.4, or 8.5, you must update to versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12 respectively. Those on older versions need to plan for an upgrade to a supported branch. The patches are now available, ending a period of heightened risk that began with the discovery of the exploitable code paths in August.