OpenAI Says Its AI Found Flaws in Software Used by Most Websites

OpenAI announced on Oct. 21 that its AI model, GPT-5.6 Sol, was instrumental in uncovering critical security flaws in PHP, a programming language that runs an estimated 70% of the internet. The discovery, part of the company's "Patch the Planet" cybersecurity initiative, led to a coordinated, two-month effort to repair the issues. OpenAI stated that this lengthy timeline was necessary due to the complexity of the task, which required significant changes to the PHP engine.

The PHP Foundation has released patched versions of the software to address the vulnerabilities. However, older versions like PHP 8.1 and earlier will not receive official fixes. The coordinated release of the patches was originally scheduled for Oct. 22 but was moved up to Oct. 21 after premature disclosures on Oct. 20 caused public concern.

The process began on July 30, 2026, when researchers from the cybersecurity firm Calif, working with OpenAI tools, started an audit of PHP at the Foundation's request. The underlying flaw had been known to the Foundation since 2024, but no one could identify a way to exploit it or how to fix it. On Aug. 11, a Calif researcher identified an exploitable vulnerability, followed by OpenAI researchers the same day. Later, another firm, Wiz, independently found a separate, related vulnerability.

The two identified vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, involve issues with how PHP manages computer memory and handles errors. Under certain conditions, attackers could exploit these weaknesses remotely, without needing login credentials, to execute malicious code on affected servers. The researchers also demonstrated that the flaws could expose sensitive information stored in server memory, including passwords, authentication tokens, and API keys. Because the vulnerabilities are in PHP's core engine, websites can be affected even if their application code is secure. Both vulnerabilities were given a critical severity score of 9.2 out of 10.

OpenAI says that human developers and security teams had examined the underlying code but were unable to fully resolve the flaws, which allowed them to persist for two years after their initial discovery. In contrast, researchers using AI demonstrated practical ways to exploit the flaws within two weeks. OpenAI highlights this incident as an example of its "Defender's Window" concept in action, which describes a critical, narrow timeframe during which organizations can use advanced AI models to find and patch vulnerabilities before those same capabilities become widely available to malicious actors.

The company argues that powerful technology will inevitably be used by bad actors, making it a collective responsibility to proactively address potential flaws. OpenAI considers this incident one of the biggest cybersecurity discoveries of 2026, given PHP's widespread use. The company has stated that every site using PHP can now safely upgrade its version to remain secure.

What happens next involves the wider adoption of these security patches. For site administrators, the immediate task is to update their PHP versions to the newly released, patched versions to protect against potential exploitation. OpenAI's "Defender's Window" concept suggests that other organizations will face similar challenges as AI-powered tools become more capable of finding and exploiting software vulnerabilities.