GPT-5.6 Sol Exposes Two Critical PHP Flaws Affecting 70% of Web Traffic

Approximately 70% of the internet’s web traffic runs on PHP, an open-source programming language that has just been found to contain two critical security vulnerabilities. These flaws, which remained undetected by human developers for two years, were identified and weaponized within two weeks by researchers utilizing OpenAI’s GPT-5.6 Sol model. The discovery highlights a significant shift in cybersecurity dynamics, where artificial intelligence is uncovering deep-seated code issues that have previously eluded traditional auditing methods.

The first key development involves the coordinated response between OpenAI, the PHP Foundation, and various security firms. After the initial identification of the vulnerabilities in late July and early August of 2026, a coalition of researchers, maintainers, and government agencies worked for two months to engineer a fix. The complexity of the task required substantial modifications to the PHP engine itself, necessitating a lengthy development cycle to ensure stability across the vast ecosystem of dependent applications.

The second point of focus is the immediate release of patched versions to mitigate the risk. The PHP Foundation released updated versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the issues. Notably, versions 8.1 and older will not receive official fixes, leaving older installations potentially exposed. The coordinated release was originally planned for October 22, 2026, but was accelerated to October 21 following premature disclosures on October 20 that generated public concern among developers and site administrators.

The technical nature of the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, centers on memory management and error handling within the core PHP engine. The first flaw occurs when the engine exhausts allocated memory during a request, potentially leaving incomplete internal data that is later misinterpreted as valid. The second involves a fatal error leaving the system pointing to already freed memory, which subsequent requests can access or corrupt. Both issues carry a critical severity score of 9.2 out of 10.

Contextually, these vulnerabilities are particularly dangerous because they exist in the core engine, meaning websites can be compromised even if their specific application code is secure. Researchers demonstrated that attackers could exploit these weaknesses remotely without login credentials to execute malicious code or expose sensitive data such as passwords and API keys stored in server memory. The ability to turn a two-year-old bug into a working exploit in just two weeks underscores the accelerating pace of AI-assisted security research.

OpenAI frames this incident within its “Defender's Window” concept, a theory introduced after its models previously interacted with Hugging Face. The company argues that there is a narrow timeframe where organizations can use advanced AI to strengthen defenses before similar capabilities become widely available to malicious actors. OpenAI maintains that it is a collective responsibility to address exploitable flaws proactively, citing recent findings by Anthropic’s Claude Mythos, which identified thousands of zero-day vulnerabilities in major operating systems and web browsers.

The timeline of the discovery began on July 30, 2026, when researchers from Calif, a founding partner in OpenAI’s “Patch the Planet” initiative, started auditing PHP at the Foundation’s request. The underlying flaw had been known since 2024, but no exploitation method or fix had been identified. On August 11, Calif researcher Ryan A. identified the exploitable vulnerability, followed by OpenAI researchers the same day. The firm Wiz independently identified an additional related vulnerability shortly thereafter.

Looking ahead, OpenAI states that every site using PHP can now safely upgrade to the latest patched versions to remain secure. The company considers this one of the most significant cybersecurity discoveries of 2026 due to the ubiquity of the language. While some argue the flaws would have remained harmless without AI’s ability to exploit them, OpenAI contends that the inevitability of AI-driven attacks necessitates proactive patching strategies for critical infrastructure.