From The Next Web · Ana Maria Constantin · · 1m 50s
AI finds critical PHP flaws affecting 70% of websites
OpenAI and Google's security teams discovered two severe vulnerabilities in PHP using AI models, forcing an emergency update and taking sites offline.
In brief
OpenAI and Google's security teams discovered two severe vulnerabilities in PHP using AI models, forcing an emergency update and taking sites offline. PHP released emergency patches for two critical flaws found by AI that affect roughly seventy percent of all websites, forcing a global patching race. Originally…
Two critical flaws in PHP
PHP released emergency patches on Wednesday for two memory-safety bugs tracked as CVE-2026-109618 and CVE-2026-109619, each rated nine point two on the CVSS v four scale.
“the only safe choice”
AI discovered the first flaw
Security firm Calif found the first vulnerability in August with help from OpenAI's GPT-5.6 Sol model during an audit of PHP's source code that OpenAI funded through its Patch the Planet initiative.
Google's Wiz team found them independently
Google's Wiz team discovered the flaws weeks later using Wiz Atlas, Google's Gemini 4 Argon and GPT-5.6 Sol. PHP's advisory credits researchers from Calif, Wiz and OpenAI together.
OpenAI and Calif disagree on what it means
OpenAI called this a Defender's Window and committed one billion dollars in subsidised access to its Daybreak cyber programme.
“No model is simply capable of unearthing 'all bugs' with simple prompts. At least for now.”
Websites went dark before the patch
The EU's CERT-EU, Britain's NCSC and the US National Security Agency all advised organisations to take systems offline. Pinboard, GrapheneOS forum, OBS and Laravel halted deployments before the fix was ready.
The patch came early after leak
PHP brought forward its release after details leaked on Hacker News. Security firm watchTowr confirmed the bugs were real before any patch existed, and a proof-of-concept exploit then circulated online.
Affects seventy percent of websites
Wiz estimates PHP runs roughly seventy percent of all websites.The flaws reach back to PHP five point four and later, more than a decade of releases.
The takeaway
PHP released emergency patches for two critical flaws found by AI that affect roughly seventy percent of all websites, forcing a global patching race.
