OpenAI Leverages GPT-5.6 Sol to Expose Critical PHP Flaws Affecting 70% of Web Traffic

A persistent code defect that stumped human developers for two years was transformed into a working remote exploit in just two weeks, highlighting a widening gap between traditional security auditing and AI-driven discovery. OpenAI announced on Monday that its GPT-5.6 Sol model, deployed under the "Patch the Planet" cybersecurity initiative, identified critical vulnerabilities in PHP. The programming language powers an estimated 70% of the internet, making the discovery a significant market event with immediate implications for server-side infrastructure and enterprise security budgets.

The technical severity of the issue is underscored by the criticality scores assigned to the two distinct flaws, both rated 9.2 out of 10. The vulnerabilities stem from memory management and error-handling defects in the PHP core engine. Specifically, the first flaw occurs when the engine exhausts allocated memory, potentially leaving incomplete data that is later misidentified as valid. The second involves a fatal error causing the engine to reference already freed memory. These conditions allow attackers to execute malicious code remotely without requiring login credentials, potentially granting them control of affected websites and access to sensitive server memory, including authentication tokens and API keys.

The remediation effort involved a complex coalition of PHP maintainers, security providers, and government agencies. The PHP Foundation released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the issues. Older versions, specifically 8.1 and below, were excluded from official fixes. The coordinated release was originally scheduled for Tuesday but was brought forward to Monday following premature disclosures on Sunday that triggered public concern. OpenAI attributed the two-month remediation timeline to the complexity of the required changes to the PHP engine.

The discovery process began on July 30, 2026, when researchers from Calif, a California-based cybersecurity firm and founding partner of the Patch the Planet program, began auditing PHP at the Foundation's request. Although the Foundation had been aware of the underlying flaw since 2024, they lacked a method to exploit or fix it. On August 11, Calif researcher Ryan A. identified the exploitable vulnerability, a finding quickly corroborated by OpenAI researchers. Independently, cybersecurity firm Wiz identified an additional related vulnerability. The two issues are tracked as CVE-2026-109618 and CVE-2026-109619.

OpenAI frames this incident as a prime example of its "Defender's Window" concept, a narrow timeframe where organizations can use frontier AI models to strengthen defenses before similar capabilities become widely available to malicious actors. The company argues that while human teams struggled to resolve the code for two years, AI-wielding researchers demonstrated practical exploitation methods rapidly. This proactive approach aligns with broader industry trends, such as Anthropic’s recent identification of thousands of zero-day vulnerabilities in major operating systems and browsers. For site operators, the immediate action is clear: upgrade to the latest patched versions to secure their infrastructure against these core engine-level threats.