AI Finds Critical PHP Vulnerabilities, Governments Pull Sites
3 min readTwo critical vulnerabilities in PHP, the language behind a huge share of the world’s websites, were patched on October 21 after frontier AI models found them before attackers did. OpenAI said its GPT-5.6 Sol model identified one of the flaws, and security firm Wiz independently discovered and reported both. Within hours, governments in Finland and the Netherlands took public web services offline as a precaution.
What the PHP vulnerabilities do
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, can let an attacker run code on a vulnerable server without any login credentials. PHP’s maintainers said every installation that serves web requests could be exposed and shipped fixes for all supported versions. Older, unsupported releases face a harder upgrade path, which is a real problem for the long tail of aging servers that still run them.
How AI found them
OpenAI described the discovery as part of its Patch the Planet initiative and said the coordinated response took roughly two months. PHP’s maintainers led the fixes, while OpenAI, Wiz, Cloudflare and other partners prepared protections ahead of public disclosure. OpenAI also said it briefed US government bodies, including the Office of the National Cyber Director and CISA, along with international partners.
OpenAI calls the gap between an AI-assisted discovery and public disclosure the “Defender’s Window.” The idea is that if frontier models can find bugs first, defenders get a head start to patch before exploits circulate. Wiz described the pair as the most severe vulnerabilities AI has discovered so far, and OpenAI called the episode one of the most impactful security issues in recent memory.
Governments pull sites, agencies sound alarms
The FBI and NSA urged organizations to patch immediately or take systems offline. Finland temporarily shut government web services, Dutch services went dark as a precaution, and in the UK the BBC and Edinburgh’s city council pulled pages. To help teams find their exposure, OpenAI released a PHP version checker as a Codex skill and pointed organizations to CISA’s binding operational directive for prioritizing patches.
Why it matters
This is the clearest demonstration yet that AI vulnerability hunting has reached internet-scale consequences. The same capability cuts both ways. OpenAI acknowledged that models like these could also help attackers build exploits, and said it is adding blocking classifiers to Daybreak, its security model, while offering $1 billion in subsidized access to frontline defenders.
Watch for exploitation attempts against unpatched servers in the coming days, and for how the industry responds to OpenAI’s proposed framework for AI-era disclosure. If you run PHP anywhere, update now.