PHP flaws affect 70% of websites

PHP flaws that could affect 70% of websites were discovered with the help of AI. OpenAI announced in a press release on Oct. 21 that researchers working under its Patch the Planet cybersecurity initiative used its AI model GPT-5.6 Sol to uncover critical security vulnerabilities in PHP. The PHP Foundation has released patched versions PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to fix the vulnerabilities. Operating as part of the Patch the Planet program, researchers from Calif began auditing PHP with OpenAI tools on July 30, 2026, at the PHP Foundation's request. The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, involve flaws in how PHP manages computer memory and handles errors.

The PHP Foundation has released patched versions PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to fix the vulnerabilities. PHP 8.1 and older versions will not receive official fixes. The coordinated release was originally scheduled for Oct. 22, but was brought forward to Oct. 21 following premature disclosures on Oct. 20, which led to public outcry.

Operating as part of the Patch the Planet program, researchers from Calif began auditing PHP with OpenAI tools on July 30, 2026, at the PHP Foundation's request. The Foundation had known about the underlying flaw since 2024 but couldn't identify an exploitation method or a fix. Calif researcher Ryan A. first identified the exploitable vulnerability on Aug. 11, followed by OpenAI researchers that same day. Subsequently, another cybersecurity firm, Wiz, independently identified an additional vulnerability.

The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, involve flaws in how PHP manages computer memory and handles errors. The first occurs when PHP runs out of allocated memory while processing a request, potentially leaving behind incomplete internal data that the engine may later mistakenly treat as valid. The second involves a related problem in which a fatal error leaves PHP pointing to memory that has already been freed, allowing subsequent requests to access or corrupt it. Under certain conditions, attackers can exploit these weaknesses remotely — without needing login credentials — to execute malicious code on affected servers, potentially taking control of websites.

Using AI, the researchers also demonstrated that the flaws could expose sensitive information stored in server memory, including passwords, authentication tokens, and API keys. Most concerning, the vulnerabilities exist in PHP's core engine, meaning websites can be affected even if their application code has no security flaws. Both vulnerabilities received a critical severity score of 9.2 out of 10.