OpenAI-Backed Researchers Find Two Critical Security Flaws in PHP

Two critical security flaws in PHP — the programming language that underpins a large share of the world’s websites — have been identified and patched after a two-month co-ordinated disclosure process involving OpenAI, independent security firms, and PHP’s own maintainers.

OpenAI announced that researchers working through its Patch the Planet initiative identified the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. The flaws relate to how PHP handles memory exhaustion and fatal errors, and under certain conditions could allow an attacker to access or corrupt memory — and potentially take control of an affected server remotely.

What the Flaws Actually Do

The vulnerabilities sit in the PHP engine itself, not in any specific plugin or website. That matters because it means the risk is not limited to one platform like WordPress or one type of site — it runs deeper.

Security firm Calif reportedly identified one of the vulnerabilities using OpenAI’s GPT-5.6 Sol model. Wiz, a separate security company, independently identified and reported both flaws. OpenAI said it then spent two months working with PHP maintainers, security providers, and other partners to prepare a fix before any public details were released — a standard co-ordinated disclosure approach designed to stop attackers exploiting a flaw before a patch exists.

PHP is estimated to power around 70 per cent of websites, though OpenAI acknowledged that figure is an estimate rather than a precise count. The PHP Foundation has not independently verified that number against an official source, so it should be treated with some caution.

The Patches Are Out

PHP maintainers have released fixed versions: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Website operators running any of those version branches should apply the relevant update and follow the official mitigation guidance published by the PHP Foundation.

Anyone who runs a website or web application built on PHP — which includes vast numbers of content-management systems, e-commerce platforms, and bespoke web apps — should check with their developer or hosting provider that the update has been applied.

Residents who simply visit websites don’t need to do anything themselves. The responsibility for patching sits with whoever owns or hosts the site.

AI’s Role in Finding the Bug

OpenAI’s involvement is notable because Patch the Planet is explicitly designed to use AI tools to help security researchers find vulnerabilities in open-source software faster than traditional manual methods alone.

The use of GPT-5.6 Sol — a model reported by OpenAI and its partners, though independent verification of its exact specifications isn’t available — to assist in identifying one of the flaws points to a growing interest in AI-assisted security research. But it’s worth being clear about what that means in practice: the model appears to have assisted a human researcher at Calif, not replaced one.

Wiz’s independent discovery of both vulnerabilities also shows that traditional security research methods remain effective. The two approaches — human-led and AI-assisted — arrived at the same answer.

What Security Experts Say

Wiz’s involvement in reporting both flaws adds credibility to the disclosure. The firm has a track record of identifying serious vulnerabilities in widely used infrastructure.

The severity of the flaws has been reported as 9.2 out of 10 on the standard vulnerability scoring scale, though that figure could not be independently verified against official PHP Foundation advisories at the time of writing.

Patching may not be instant for every organisation. Older websites, legacy systems, or sites managed by small teams may need testing before updates go live. Some hosting providers will handle updates automatically; others will require the site owner or a developer to act.

What This Means for Kent Residents

Kent organisations running PHP-based websites — including Kent County Council, Medway Council, NHS Kent and Medway ICB, schools, universities, and local businesses — should check with their developers or hosting providers that the relevant PHP patch has been applied. No confirmed exploitation or service disruption affecting Kent has been identified. For most residents, no action is needed, but anyone who owns or manages a website should treat this as a prompt to verify their hosting environment is up to date.