Critical PHP Flaws Exposed, Patched After Two-Year Deadlock
AI tools turned a long-standing bug into a working exploit, forcing a coordinated security fix for a vast swath of the web.
By Jabari Long ·
Security experts spent two years unable to crack a known bug inside PHP, the language behind a huge portion of the internet. That stalemate ended in just 14 days. Researchers using OpenAI's GPT-5.6 Sol model found ways to exploit the flaw, forcing an urgent security patch. The fix for these critical vulnerabilities is now available.
The PHP Foundation released updated versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the issue. An official statement from OpenAI on Oct. 21 confirmed the release. The plan had been to ship the patch on Oct. 22. The timeline was moved up a day after details leaked publicly on Oct. 20.
The effort was part of a joint initiative called Patch the Planet. Audits by Calif and other groups began on July 30 at the request of the PHP Foundation. The foundation first saw the bug in 2024. It could not figure out how to fix it or how to use it. Calif researchers found a way to exploit it on Aug. 11. OpenAI researchers found a way the same day. Another firm, Wiz, later found a separate, related issue.
The two flaws are labeled CVE-2026-109618 and CVE-2026-109619. They deal with memory handling. The first issue can leave behind bad data when memory runs out. The second points to memory that was already freed. Attackers can use these problems to run code on a server without a password. This allows them to take over a website. The issues also risk leaking passwords, tokens, and keys. Both flaws are rated 9.2 out of 10 for severity. They live in the core engine, so even safe code can be affected. PHP 8.1 and older versions will not get these fixes.
OpenAI calls this incident a major win for its Defender's Window idea. The company says it is better to patch holes before bad actors find them. The goal is to close gaps that could be used by attackers later. This follows a report from Anthropic's Claude Mythos. That model found thousands of zero-day flaws in major systems and browsers.
Websites using PHP must upgrade now to stay safe. The release of these patches ends the threat. It also sets a new bar for how fast AI can solve tough security problems. No date is set for the next update.
