70 Percent of Websites Needed Emergency PHP Updates After AI Found Old Bugs

The PHP Foundation moved up its release schedule to yesterday, October 21, after details about serious security flaws leaked to the public on October 20. The organization issued patched versions of PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the issues. This change came after researchers working with OpenAI highlighted how quickly artificial intelligence could turn a known weakness into a working attack. The early rollout was designed to give site administrators a clear window to upgrade before the full details became widely available to hackers.

The scope of this incident is massive because PHP powers an estimated 70 percent of the internet. Two specific vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, received a critical severity score of 9.2 out of 10. These flaws exist in the core engine of the language, which means they can affect websites even if the application code itself is secure. Sites running PHP 8.1 or older versions will not receive official fixes, so they must upgrade to a newer major version to stay protected.

The people involved in uncovering the issues included researchers from Calif, a California-based cybersecurity firm and founding partner of OpenAI's Patch the Planet initiative. They began auditing PHP on July 30, 2026, at the request of the PHP Foundation. On August 11, Calif researcher Ryan A. identified an exploitable vulnerability, and OpenAI researchers found the same flaw that same day. Another firm, Wiz, independently identified a separate but related vulnerability during the same period. This coalition of researchers, maintainers, security providers, and government agencies worked for two months to coordinate the fix.

The technical nature of the bugs involves how PHP manages memory and handles errors. The first flaw occurs when the system runs out of allocated memory while processing a request. This can leave behind incomplete internal data that the engine later mistakes for valid information. The second issue happens when a fatal error causes PHP to point to memory that has already been freed. This allows subsequent requests to access or corrupt that memory. Under certain conditions, attackers can exploit these weaknesses remotely without needing login credentials to execute malicious code on affected servers.

The stakes for webmasters are high because the researchers demonstrated that these flaws could expose sensitive data stored in server memory. This includes passwords, authentication tokens, and API keys. OpenAI noted that human developers had examined the underlying code since 2024 but could not fully resolve the issues or identify a way to exploit them. The bugs had persisted for two years without a known fix. In contrast, the AI-assisted researchers demonstrated practical exploitation methods within two weeks of starting their work.

OpenAI framed this discovery as a prime example of what it calls the Defender's Window. The company describes this as a narrow timeframe where organizations can use advanced AI models to find and patch vulnerabilities before those same capabilities become widely available to malicious actors. OpenAI argues that powerful technology will inevitably be used by bad actors, making it a collective responsibility to act proactively. The company cited a recent finding by Anthropic's Claude Mythos, which identified thousands of zero-day vulnerabilities in major operating systems and web browsers, to support this view.

For readers in Texas and the South Central states, the practical takeaway is immediate action. If you manage a website or application that uses PHP, you should verify your version today. If you are running one of the patched versions, apply the update. If you are on an older version, plan for an upgrade. The coordinated effort between private firms and government agencies shows how the cybersecurity landscape is shifting, with AI playing a central role in both finding and fixing problems that have eluded human experts for years.