AI models helped catch a critical flaw in the code that runs much of the web

PHP, the programming language that runs a large share of the world's websites, got emergency security patches on October 21 after researchers found two critical flaws in rapid succession. Read more: PHP critical vulnerability AI

The flaws, cataloged as CVE-2026-109618 and CVE-2026-109619, each scored 9.2 out of 10 for severity, near the top of the scale. Both could let an attacker run code on a server without logging in first, a technique known as remote code execution.

PHP's own development team shipped the fix one day after the vulnerabilities were disclosed. The patched versions, including PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, close holes that put a huge number of sites at risk, since PHP underpins major platforms including WordPress, Drupal, Joomla and Magento.

How the AI found the bugs

The discovery traces back to OpenAI's Patch the Planet initiative, launched in June 2026 with the security firm Trail of Bits to find bugs in widely used open-source software. OpenAI says its GPT-5.6 Sol model identified one of the two flaws before any attacker did.

The security firm Wiz said it independently discovered and reported both vulnerabilities. According to Wiz's own account, it used Google's Gemini 4 Argon model, through its Wiz Atlas platform, to help find the bug, build test exploits, construct attack detection and validate the eventual patch.

Related: OpenAI discloses its AI agents disabled internal safety monitors

Wiz also warned that the same AI tools can lower the bar for attackers. Large language models, it said, can help adapt an exploit to different PHP versions, configurations and memory layouts, tasks that once required substantial manual rework. Vulnerabilities "that once seemed impractical to exploit become viable targets," the firm said.

Security researchers reported exploitation attempts in the wild hours before the patches shipped, and PHP's advisory said there is no safe workaround short of installing the update.

A coordinated fix and a pledge

OpenAI says it coordinated the response for roughly two months, working with PHP's maintainers, Wiz and Cloudflare. United States government offices took part too, including the Cybersecurity and Infrastructure Security Agency, the White House's Office of the National Cyber Director and a White House unit called the Super Intelligence Force. CERT-EU and the Australian Cyber Security Centre each issued advisories urging organizations to patch immediately.

In an October 21 post, OpenAI called the flaws "one of the most impactful security issues in recent memory" and said it expects AI-assisted discoveries like this to increase sharply in the coming months.

The company pledged $1 billion in subsidized access to its Daybreak security tool for what it calls Frontline Defenders, organizations with limited security resources that protect essential services.

OpenAI also proposed a five-stage framework for handling future AI-discovered vulnerabilities in widely used software. The stages are validating and testing a fix, giving defenders time to prepare, bringing in government partners on critical systems, pushing the update through distributors, and publishing guidance once the patch ships.

PHP 8.2, one of the versions patched this week, reaches the end of its support life on December 31, 2026, after which it will get no further security fixes at all.