70 percent of the web just got a critical security update

Seventy percent of the internet runs on a single piece of code that just became significantly more dangerous. OpenAI announced on Tuesday that its newest AI model found a critical weakness in PHP, the open source language that quietly powers the majority of websites globally. This discovery has triggered a major security scramble for developers and system administrators across the region and beyond. The stakes are high because the flaw allows attackers to take control of servers without needing a user login. This marks one of the largest cybersecurity events of the year for web infrastructure.

The core issue involves two distinct but related bugs in how PHP handles memory. These flaws have existed since 2024 but were previously considered theoretical by many human developers. The PHP Foundation knew about the underlying problem but could not find a way to exploit it or a simple fix. This changed when a team from Calif, a California based cybersecurity firm, began auditing the code on July 30. On August 11, a researcher at Calif identified the first exploitable vulnerability. OpenAI researchers confirmed the finding later that same day. A separate firm named Wiz independently found a second related issue shortly after.

The two vulnerabilities, labeled CVE-2026-109618 and CVE-2026-109619, both carry a critical severity score of 9.2 out of 10. The first bug happens when PHP runs out of memory while processing a request. This can leave behind incomplete data that the engine later mistakes for valid information. The second bug occurs when a fatal error causes PHP to point to memory that has already been freed. This allows subsequent requests to access or corrupt that space. Because these issues live in the core engine, they can affect sites even if the application code itself is secure.

OpenAI states that human teams had looked at the code for two years without a full resolution. In contrast, the AI assisted researchers created working exploits in just two weeks. This speed highlights a new dynamic in cybersecurity. Attackers can now use these tools to find and exploit weaknesses remotely. The flaws can also expose sensitive data stored in server memory, such as passwords, authentication tokens, and API keys. This makes the risk immediate for any site that has not yet updated its software.

The patch release was originally scheduled for October 22. However, premature disclosures on October 20 caused public concern and forced the release to be moved up to October 21. The PHP Foundation has now released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Sites running PHP 8.1 or older will not receive official fixes for these specific issues. This leaves older systems vulnerable unless they upgrade to a newer major version. Administrators are urged to check their versions immediately to ensure they are covered by the new updates.

OpenAI is using this incident to promote a concept called the Defender's Window. The company argues that there is a narrow timeframe where organizations can use advanced AI to find and fix problems before attackers do. This idea follows a previous event where OpenAI models hacked the platform Hugging Face. The company believes that powerful technology will eventually be used by bad actors. Therefore, it views proactive patching as a collective responsibility. This approach aims to strengthen defenses before the same AI driven attack capabilities become widely available to malicious groups.

The coordination to fix the bugs took two months involving a coalition of researchers, maintainers, and government agencies. OpenAI attributes this timeline to the complexity of the task, which required major changes to the PHP engine. The company considers this one of the biggest discoveries of 2026 due to the language's ubiquity. The event underscores how AI is reshaping the pace of security research. What once took years of human analysis can now be achieved in weeks with the right tools.

There is some debate about the true impact of these findings. Some argue that the flaws would never have been exploitable without AI, making them effectively harmless in the past. OpenAI challenges this view by pointing to other recent discoveries. Anthropic's model recently identified thousands of zero day vulnerabilities in major operating systems and browsers. This suggests that AI is uncovering a hidden layer of risk in existing software. For the Pacific Northwest tech community, which hosts many digital infrastructure companies, this serves as a clear signal to review their PHP dependencies now.