70 Percent of Websites Now Have a New Way to Stay Secure

If you manage a website, the rules for staying safe just changed. For the first time, a major piece of web software has been patched specifically because an artificial intelligence model found a way to break it that human experts had missed for years. This shift means that the gap between finding a bug and fixing it has shrunk dramatically, altering how security teams must operate in the coming months.

The first key development is the scale of the impact. PHP is an open-source programming language that underpins an estimated 70% of the internet. Researchers working under the Patch the Planet initiative used OpenAI’s GPT-5.6 Sol model to identify two critical flaws in this core software. Because so many sites rely on this language, the discovery affects a vast portion of the web, from small blogs to large commercial platforms. The PHP Foundation has now released updated versions, specifically 8.2.35, 8.3.36, 8.4.27, and 8.5.12, to address these issues.

The second key point is the speed at which the AI worked. The underlying bug had been known to the PHP Foundation since 2024, but human developers could not figure out how to exploit it or how to fix it. In late July, researchers from the cybersecurity firm Calif began auditing the code with AI tools. By August 11, they had identified a working method to exploit the flaw. OpenAI researchers confirmed the find the same day. A separate firm named Wiz also found a related vulnerability. This process took about two weeks, a stark contrast to the two years the issue had sat unresolved by human teams.

The third key point involves the specific nature of the threats. The two vulnerabilities, labeled CVE-2026-109618 and CVE-2026-109619, stem from how PHP handles memory and errors. In one case, the system runs out of memory and leaves behind incomplete data that it later treats as valid. In the other, a fatal error causes the system to point to memory that has already been freed. Attackers can use these weaknesses remotely without needing login credentials. They can execute malicious code or steal sensitive data like passwords and API keys. Both flaws have a severity score of 9.2 out of 10.

The context for this event is a concept OpenAI calls the Defender's Window. The company argues that there is a narrow timeframe where defenders can use advanced AI to find and fix problems before attackers do. This incident is being used as a prime example of that concept in action. OpenAI notes that this discovery is one of the biggest cybersecurity events of 2026 due to how common PHP is. The company suggests that because powerful technology will inevitably be used by bad actors, it is a collective responsibility to fix flaws proactively.

The outlook for website owners is clear: upgrade now. The coordinated release of the patches was originally planned for October 22, but it was moved up to October 21. This change happened because some details were disclosed early on October 20, causing public concern. Sites using PHP 8.1 or older will not receive official fixes. While some argue that the flaws were only dangerous because AI could exploit them, OpenAI maintains that proactive defense is the best strategy. Other AI models, such as Anthropic's Claude Mythos, have recently found thousands of similar vulnerabilities in major operating systems and browsers, suggesting this trend will continue.

For New England readers, this story highlights a broader shift in how technology is secured. As AI becomes more central to finding bugs, the pressure to update software will only increase. The two-month period it took to fix these issues was due to the complexity of changing the PHP engine. However, the ability of AI to find these flaws in two weeks sets a new benchmark for speed. Organizations are now expected to move faster than ever to keep their defenses strong.