OpenAI Helped Discover the Critical PHP Vulnerabilities That Shook the Global Internet
Originally published in Turkish. Read the original →
It has been revealed that OpenAI's AI technology was behind the discovery of the critical vulnerabilities in the PHP programming language, which powers most of the world's websites, that triggered a global cybersecurity alarm. The GPT-5.6 Sol model, used by cybersecurity firm Calif under the company's Patch the Planet initiative, made it possible to find remote code execution vulnerabilities that had gone unnoticed for more than a decade.
The story behind the critical vulnerabilities found in the PHP programming language, one of the most important building blocks of the global internet infrastructure, which triggered urgent cybersecurity alarms worldwide, is starting to become clear. It has been officially confirmed that advanced AI models developed by OpenAI played a direct role in bringing to light these dangerous flaws in the PHP core, which powers roughly 70 percent of active websites and content management systems around the world.
Discovered as a result of extensive security scans carried out in August and September and dubbed PHP2Shell in the security world, these vulnerabilities recently mobilized the FBI, the NSA, CISA and the national cybersecurity centers of many countries. Finding these vulnerabilities, which had been hiding in PHP's core source code for more than a decade and had slipped past traditional auditing tools, with the help of AI before they fell into the hands of malicious hackers prevented a possible global digital disaster.
The Discovery Through GPT-5.6 Sol and a Collaboration With Calif
According to official information shared by OpenAI, the process of finding the critical bugs in the PHP core began with the work of experts at cybersecurity research company Calif. Calif researchers used GPT-5.6 Sol, OpenAI's frontier model known for its cybersecurity and low-level code analysis capabilities, to examine PHP's complex source code architecture in depth.
Memory management and input validation bugs that human researchers and standard static code analysis software had failed to notice for years were caught thanks to the large language model's semantic evaluation of code paths. With researchers at Wiz, the cybersecurity firm within Google, independently identifying the same vulnerable points during the same period, the findings were quickly shared with the PHP Foundation and the core developer team.
What Is the Patch the Planet Initiative and How Does It Work?
This historic discovery in PHP went on record as one of the most concrete successes of Patch the Planet, the initiative OpenAI launched to protect the open-source software ecosystem. Forming an important part of the company's cyber defense vision, the program aims to find and fix security vulnerabilities in the world's most critical open-source projects before cybercriminals do.
The initiative's core working principles and its contributions to the cybersecurity ecosystem can be grouped under these headings:
- AI-Powered Deep Auditing: Advanced language models and autonomous security agents scan open-source codebases with millions of lines to detect complex logic bugs and memory overflow flaws.
- Funding and Model Support: OpenAI gives independent security researchers and expert organizations both financial resources and early access to its most powerful AI models.
- Responsible Disclosure and Coordination: Discovered vulnerabilities are patched in coordination with the relevant software foundations, cloud providers (Cloudflare, AWS and others) and developer communities before they are announced publicly.
Why Are CVE-2026-109618 and CVE-2026-109619 So Dangerous?
The two core vulnerabilities uncovered with AI assistance and officially classified as CVE-2026-109618 and CVE-2026-109619 are rated with risk scores of 9.2 and above, at the top end of the CVSS criticality scale. Counted among the most dangerous flaws in software history, they open the door directly to Remote Code Execution (RCE) on target servers.
When attackers exploit these vulnerabilities, they can run fully privileged commands on the server with specially crafted HTTP requests, without being stopped by any username or password check. This can lead to devastating outcomes such as theft of corporate databases, changes to server configurations, deployment of ransomware and the planting of persistent backdoors in systems.
A Global Alarm and Websites Taken Offline
Right after the security patches were released, cyber intelligence units announced that threat actors had started automated scanning to target unpatched servers. National cybersecurity authorities in Europe and Asia, led by the FBI and CISA in the US, issued urgent calls for organizations to update their systems immediately.
Many ministries, municipalities, port operators and public institutions that could not install the patches immediately because of technical dependencies or operational processes chose to temporarily take their websites offline rather than risk a data leak. These planned outages in countries such as France, Germany, the Netherlands and Japan showed the whole world once again how serious the vulnerability was.
The Age of AI in Cybersecurity: The Balance Between Defense and Attack
OpenAI's role in the PHP crisis brought the dual nature of AI technologies in the cybersecurity world back onto the agenda. Until now there were serious concerns that advanced language models could be used by malicious hackers to automate cyberattacks and find zero-day vulnerabilities. The PHP case, however, proved that the same technology can also be a game-changing shield on the defensive side.
Cybersecurity experts and system administrators point out that AI-assisted vulnerability discoveries like this will become much more frequent in the period ahead. The basic steps developers and organizations need to take to secure their servers are quite clear:
- Urgent Version Update: All systems running on PHP need to be upgraded without delay to PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which contain the security patches.
- WAF and Network Isolation: Legacy applications that cannot be updated directly must be placed behind a Web Application Firewall (WAF) with up-to-date signatures, and external access must be restricted.
- Continuous Log and Integrity Auditing: Server access logs should be reviewed retroactively for possible exploitation attempts, and system files should be checked for any unauthorized changes.
This huge crisis, averted through the joint work of OpenAI and security researchers, shows that AI-assisted proactive code auditing in the open-source world is no longer a choice but an indispensable necessity for global internet security.
