70% of the Web: How AI Solved a Two-Year PHP Mystery

The backbone of the modern internet just underwent its most significant stress test of the year.

On Tuesday, the PHP Foundation released emergency updates for four major versions of the language, closing two critical security holes that affect an estimated 70% of all websites. The incident marks a pivotal moment in cybersecurity history, where artificial intelligence did not just assist in finding bugs, but fundamentally changed the timeline from discovery to exploitation. For two years, human engineers knew a flaw existed in PHP’s core engine but could not figure out how to trigger it. AI-assisted researchers cracked the code in just two weeks, turning a latent issue into a remote attack vector that no longer requires login credentials.

The timeline of this crisis reveals a gap in traditional security methodologies that has persisted for years. The underlying flaw was first identified by the PHP Foundation in 2024, but it remained dormant because no one could determine a practical method to exploit it or a clean way to fix it. That changed on July 30, 2026, when the foundation requested an audit under OpenAI’s “Patch the Planet” initiative. By August 11, researchers from Calif, a California-based cybersecurity firm and the program's founding partner, identified the exploitable vulnerability using GPT-5.6 Sol. OpenAI’s internal team confirmed the finding the same day. Shortly after, Wiz, another security firm, independently discovered a second related flaw. Together, these issues were tracked as CVE-2026-109618 and CVE-2026-109619.

Both vulnerabilities are rated critical, carrying a severity score of 9.2 out of 10. They stem from how PHP manages memory and handles errors. The first flaw occurs when the engine runs out of allocated memory during a request, leaving behind incomplete data that it later misinterprets as valid. The second involves a fatal error that leaves the engine pointing to memory that has already been freed, allowing subsequent requests to corrupt it. Because these issues reside in the core engine rather than application-specific code, websites are vulnerable even if their own programming is flawless. Attackers can exploit these weaknesses remotely to execute malicious code or steal sensitive data stored in server memory, such as passwords, authentication tokens, and API keys.

The response phase required a coordinated effort that stretched over two months. OpenAI facilitated a coalition of PHP maintainers, security providers, and government agencies to develop fixes. The complexity of the task, which necessitated major changes to the PHP engine, contributed to the duration. The coordinated release of patched versions, 8.2.35, 8.3.36, 8.4.27, and 8.5.12, was originally scheduled for Wednesday. However, premature disclosures on Monday triggered public outcry, forcing the team to bring the release forward to Tuesday. PHP 8.1 and older versions will not receive official fixes, meaning sites running those versions must upgrade to remain secure.

OpenAI frames this incident as a prime example of its “Defender’s Window” concept. This theory suggests there is a narrow timeframe during which organizations can use advanced AI models to fortify their defenses before those same capabilities become widely available to threat actors. The company argues that powerful technology will inevitably be used by bad actors, making proactive remediation a collective responsibility. This stance contrasts with the view that these flaws would have remained harmless without AI, since humans could not exploit them for two years. OpenAI counters that the ability to find and fix these issues quickly is the key to maintaining security in an AI-driven landscape. The company notes that Anthropic’s Claude Mythos recently identified thousands of zero-day vulnerabilities in major operating systems and browsers, reinforcing the urgency of this new security paradigm.

What happens next depends on how quickly the global web adapts. While every site using PHP can now safely upgrade, the sheer scale of the affected infrastructure means the transition will take time. For developers, the lesson is clear: the era of passive security, where known bugs sit unexploited, is ending. The integration of AI into both offensive and defensive security strategies is no longer optional but essential for maintaining the integrity of the web.