GPT-5.6 Sol Exposes Critical PHP Flaws Affecting 70% of Web Traffic

An estimated 70% of the internet runs on PHP, a programming language that now faces a critical security reckoning following the discovery of deep-seated vulnerabilities. On Oct. 21, OpenAI announced that its GPT-5.6 Sol model, operating under the “Patch the Planet” cybersecurity initiative, identified flaws that allow remote attackers to execute malicious code on servers without login credentials. The incident highlights a shifting dynamic in cybersecurity, where artificial intelligence is not only finding bugs faster than human developers but is also demonstrating how to exploit them with unprecedented speed.

The core of the issue lies in two specific vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, which both received a critical severity score of 9.2 out of 10. These flaws stem from how the PHP engine manages computer memory and handles errors. In the first case, if PHP runs out of allocated memory while processing a request, it may leave behind incomplete internal data that the engine later mistakes for valid information. The second flaw involves a fatal error that leaves the system pointing to memory that has already been freed, allowing subsequent requests to access or corrupt that space. Because these issues reside in the core engine, websites can be compromised even if their specific application code is secure.

The timeline of the discovery illustrates the growing capability of AI-assisted security research. The PHP Foundation had known about the underlying flaw since 2024 but lacked the method to exploit or fix it. On July 30, 2026, researchers from Calif, a founding partner of the Patch the Planet program, began auditing PHP with OpenAI tools. By Aug. 11, Calif researcher Ryan A. and OpenAI researchers independently identified the exploitable vulnerability. Shortly thereafter, the security firm Wiz identified an additional related flaw. The AI-assisted team demonstrated practical ways to exploit these weaknesses within just two weeks, a stark contrast to the two years human developers spent examining the code without success.

The PHP Foundation released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 on Oct. 21. This coordinated release was originally scheduled for Oct. 22 but was moved forward after premature disclosures on Oct. 20 sparked public concern. Versions of PHP 8.1 and older will not receive official fixes, meaning site administrators must upgrade to newer versions to stay secure. OpenAI described this event as one of the most significant cybersecurity discoveries of 2026, citing the ubiquity of the language and the complexity of the required engine changes.

OpenAI frames this incident through the lens of its “Defender's Window” concept, a timeframe where organizations can use frontier AI models to patch defenses before those same capabilities become widely available to malicious actors. The company argues that powerful technology will inevitably be used by bad actors, making proactive defense a collective responsibility. This perspective is reinforced by recent findings from Anthropic’s Claude Mythos, which identified thousands of zero-day vulnerabilities in major operating systems and web browsers. For Texas and South Central businesses relying on web infrastructure, the lesson is clear: the window to secure systems against AI-driven threats is narrowing.

The broader implication is that the traditional cycle of vulnerability discovery and patching is accelerating. While some argue that flaws only become dangerous when AI can exploit them, the rapid conversion of dormant bugs into working exploits suggests that the risk is tangible and immediate. As more organizations integrate AI into their security workflows, the pressure to upgrade and patch legacy systems will only increase, making the next two months a critical period for web administrators across the region.