ChatGPT exposed critical PHP flaws in 70% of websites
AI Unlocks Massive Security Flaws in PHP, Testing the Limits of the “Defender’s Window”
In a remarkable collaboration between artificial intelligence and global cybersecurity experts, researchers uncovered critical security flaws deep within the backbone of the internet: PHP. This finding, spearheaded by OpenAI’s “Patch the Planet” initiative, didn’t just expose technical vulnerabilities; it highlighted the urgent need for a collective, proactive defense against emerging threats.
The core of the discovery involved leveraging OpenAI’s powerful AI model, GPT-5.6 Sol, to scan the world’s most widely used open-source programming language, PHP. Since PHP powers an estimated 70% of the internet, flaws in this engine pose an existential threat to global digital infrastructure. The researchers determined that these vulnerabilities resided not just in application code, but in the core engine managing memory and error handling.
The AI-assisted audit revealed two critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619, which carried a severe criticality score of 9.2 out of 10. These issues allowed attackers to exploit weaknesses in how PHP managed memory and handled errors. Specifically, these flaws enabled remote exploitation—meaning malicious code could be executed on affected servers without requiring any login credentials.
The potential fallout was staggering. By exploiting these weaknesses, malicious actors could access and corrupt sensitive data stored in server memory, including passwords, authentication tokens, and API keys. Because the vulnerabilities existed in PHP‘s core engine, the exposure was not limited to specific application code, affecting virtually every website globally.
The discovery underscored a significant lag between vulnerability identification and resolution. While human developers and security teams took two years to fully resolve the flaws after the initial discovery, AI-wielding researchers demonstrated practical ways to exploit these weaknesses within just two weeks. This contrast prompted a critical discussion about the speed and efficacy of modern cybersecurity efforts.
OpenAI frames this incident within the context of the “Defender’s Window” concept. The company argues that while flaws may seem harmless in isolation, powerful, revolutionary technologies will inevitably be seized by bad actors. Therefore, they stress that it is a shared responsibility to act proactively, using advanced tools to find and patch exploitable weaknesses before malicious threat actors can widely deploy them.
To address the emergency, the PHP Foundation swiftly coordinated a fix. Patched versions of PHP, including 8.2.35, 8.3.36, 8.4.27, and 8.5.12, were released to secure the ecosystem. This coordinated effort, involving researchers, maintainers, and government agencies, demonstrated that when AI is applied to global infrastructure, it can accelerate the defensive response and fortify the digital landscape for everyone.
Buy on Amazon
Credit
