OpenAI Discovers Critical Flaws Affecting 70% of the Web

Website owners and developers in New York and New Jersey face a significant shift in cybersecurity protocols following the announcement of critical vulnerabilities in PHP, the programming language that powers approximately 70% of the internet. The discovery necessitates immediate action, as the flaws allow remote attackers to execute malicious code without login credentials. The PHP Foundation has released updated versions, and organizations running older systems must now prioritize upgrades to maintain security.

The timeline of this discovery reveals a two-year struggle for human experts. The PHP Foundation became aware of the underlying issue in 2024 but failed to identify a method for exploitation or a permanent fix. On July 30, 2026, the Foundation requested assistance from OpenAI and its founding partner, Calif. By August 11, researchers from Calif and OpenAI had identified the exploitable nature of the bug. Shortly thereafter, the firm Wiz independently discovered a second related vulnerability. These findings were coordinated with security providers and government agencies over a two-month period to ensure a robust fix was developed.

The two vulnerabilities, designated as CVE-2026-109618 and CVE-2026-109619, involve critical errors in how PHP manages memory and processes errors. The first flaw occurs when the system runs out of allocated memory, potentially leaving incomplete data that the engine later misinterprets as valid. The second flaw leaves the system pointing to freed memory after a fatal error, allowing subsequent requests to access or corrupt that space. Both issues carry a severity score of 9.2 out of 10, indicating a high risk of remote exploitation that can lead to full server control.

The coordinated release of patches was originally scheduled for October 22, 2026. However, premature disclosures on October 20 led to public concern, prompting the Foundation to bring the release forward to October 21. The patched versions include PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Users of PHP 8.1 and older versions will not receive official fixes and must consider upgrading to a supported version. OpenAI states that all sites can now safely upgrade to these versions to remain secure.

OpenAI attributes the successful resolution to the use of its GPT-5.6 Sol model under the Patch the Planet initiative. The company highlights this incident as a prime example of the Defender's Window concept. This framework describes a narrow timeframe during which organizations can use advanced AI to find and patch weaknesses before those same capabilities become widely available to malicious actors. The company argues that proactive measures are a collective responsibility, noting that other AI models have recently identified thousands of zero-day vulnerabilities in major operating systems and browsers.

The incident illustrates the changing dynamic between human and AI capabilities in security research. While human developers examined the code for two years without resolving the flaws, AI-wielding researchers demonstrated practical exploitation methods within two weeks. OpenAI suggests that the flaws might not have been exploitable without AI assistance, yet it maintains that the potential for future threats requires immediate defense. The company views this discovery as one of the most significant cybersecurity events of 2026 due to the widespread use of PHP.

For New York and New Jersey businesses, the next steps involve auditing their web infrastructure. IT teams should verify their current PHP versions and upgrade to the latest patched releases. Organizations relying on PHP 8.1 or earlier should plan for migration to supported versions. This proactive approach aligns with the broader industry shift toward using AI tools to strengthen digital defenses before attackers can leverage them.

The cooperation between the PHP Foundation, OpenAI, Calif, Wiz, and government agencies demonstrates the effectiveness of coordinated response efforts. As AI models continue to advance in their ability to find software weaknesses, the window for defenders to act may shrink. Staying ahead of these capabilities will be essential for maintaining the integrity of web services across the region and beyond.