AI Finds Old Web Bug That Humans Missed for Two Years
A two-year-old flaw in PHP, the language behind most of the web, was turned into a working exploit by AI tools in just two weeks, prompting urgent patches for millions of sites.
By Christopher Reed ·
The tension at the heart of this story is a stark contrast in timelines. Human developers identified a security flaw in PHP back in 2024 but could not figure out how to exploit or fix it. That same flaw sat dormant for two years. Then, in the summer of 2026, researchers using OpenAI’s GPT-5.6 Sol model turned the theoretical bug into a working exploit in just two weeks. The speed of that shift has forced a rapid response across the web.
The numbers behind the incident are significant. PHP is an open-source language that powers an estimated 70 percent of the internet. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, both received a critical severity score of 9.2 out of 10. The PHP Foundation released patched versions on Oct. 21, moving up the schedule from Oct. 22 after premature disclosures sparked public concern. The fixed versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Versions 8.1 and older will not receive official fixes.
The people and organizations involved in uncovering and fixing the issue form a broad coalition. The audit began on July 30, 2026, at the request of the PHP Foundation. Researchers from Calif, a California-based cybersecurity firm and founding partner of OpenAI’s Patch the Planet initiative, started the work. On Aug. 11, Calif researcher Ryan A. identified the exploitable vulnerability, and OpenAI researchers confirmed it the same day. Another firm, Wiz, independently found a second related vulnerability. OpenAI then coordinated with PHP maintainers, security providers, and government agencies to develop the fix over the following two months.
The flaws themselves involve how PHP manages memory and handles errors. The first occurs when the system runs out of allocated memory during a request, leaving behind incomplete data that the engine might later treat as valid. The second happens when a fatal error causes PHP to point to memory that has already been freed, allowing later requests to access or corrupt it. Because these issues exist in the core engine, they can affect websites even if the application code is secure. Attackers can exploit these weaknesses remotely without login credentials to run malicious code or steal sensitive data like passwords and API keys.
The stakes are high because of PHP’s ubiquity. OpenAI calls this one of the biggest cybersecurity discoveries of 2026. The company is using the incident to illustrate its concept of the Defender's Window. This is the idea that there is a narrow timeframe where organizations can use advanced AI to find and patch flaws before bad actors get their hands on the same capabilities. OpenAI argues that if powerful technology will inevitably be used by attackers, it is a collective responsibility to act proactively. This stance challenges the view that the bugs were harmless because humans could not exploit them without AI.
The incident highlights a shifting dynamic in cybersecurity. For two years, human teams looked at the code and could not resolve the issue. AI-wielding researchers, however, demonstrated practical exploitation methods quickly. While some may argue the bugs were only a threat because AI found them, OpenAI maintains that the window for defenders is closing. The rapid patching process, driven by AI-assisted discovery, shows how the industry is adapting to a new era where tools that once seemed futuristic are now central to keeping the web secure.
Source: Tom's Hardware
