OpenAI Leverages GPT-5.6 Sol to Expose Critical Flaws in PHP Core

The foundation of the modern web relies heavily on the PHP programming language, a ubiquitous open-source tool estimated to underpin 70% of all websites. On Oct. 21, OpenAI disclosed that its GPT-5.6 Sol model, utilized within the company’s “Patch the Planet” cybersecurity initiative, had identified critical security vulnerabilities in this core infrastructure.

The discovery underscores a shifting dynamic in cybersecurity where artificial intelligence accelerates the identification of complex bugs. Researchers from Calif, a California-based firm and founding partner of the Patch the Planet program, began auditing PHP on July 30 at the request of the PHP Foundation. While the Foundation had been aware of the underlying defect since 2024, human developers struggled to determine how it could be exploited or fixed. It was not until Aug. 11 that Calif researcher Ryan A. identified the exploitable nature of the flaw, with OpenAI’s researchers confirming the vulnerability the same day.

A second vulnerability was independently identified by the cybersecurity firm Wiz, resulting in two distinct critical issues tracked as CVE-2026-109618 and CVE-2026-109619. Both flaws stem from how the PHP engine manages memory and processes errors. The first occurs when PHP exhausts allocated memory during a request, potentially leaving incomplete internal data that the engine later misidentifies as valid. The second involves a fatal error that causes PHP to point to already freed memory, allowing subsequent requests to access or corrupt that space. Both vulnerabilities received a critical severity score of 9.2 out of 10.

These defects are particularly concerning because they reside in the PHP core engine, meaning websites are vulnerable even if their specific application code is secure. Attackers can exploit these weaknesses remotely without login credentials to execute malicious code, potentially seizing control of servers. Furthermore, the flaws can expose sensitive data stored in server memory, including passwords, authentication tokens, and API keys. While human teams examined the code for two years without a resolution, AI-assisted researchers developed practical exploit methods in just two weeks.

In response, the PHP Foundation released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Versions 8.1 and older will not receive official fixes, requiring users to upgrade to remain secure. The coordinated release was moved up from Oct. 22 to Oct. 21 following premature disclosures on Oct. 20 that generated public concern. OpenAI coordinated a coalition of researchers, maintainers, and government agencies to address the issues over a two-month period, a timeline attributed to the complexity of the required engine changes.

OpenAI positions this incident as a prime example of its “Defender’s Window” concept, a narrow timeframe where organizations can use frontier AI to patch defenses before malicious actors gain similar capabilities. The company argues that proactive remediation is a collective responsibility, especially as models like Anthropic’s Claude Mythos recently identified thousands of zero-day vulnerabilities in major operating systems and browsers. This event highlights the growing reliance on AI to secure the digital infrastructure that supports global connectivity.