AI Helps Find Critical PHP Flaws; Attacks Rise but Exploits Remain Limited
OpenAI's GPT-5.6 Sol assisted researchers in uncovering severe PHP flaws affecting 70% of websites.
Why it matters: Legal and tech professionals face new challenges as AI accelerates discovery of critical cybersecurity flaws, raising compliance and risk management stakes.
- OpenAI’s GPT-5.6 Sol aided identification of PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 with a severity score of 9.2.
- PHP powers around 70% of websites, including WordPress, Wikipedia, Etsy, and Yahoo.
- Security patches were released October 21, 2026, but older PHP versions remain at risk, according to the PHP Foundation.
- Cloudflare detected a jump from thousands to millions of attack attempts post-disclosure, though successful exploits stayed rare.
- Security experts, including OpenAI’s CEO Sam Altman, emphasize urgent patching and multifactor authentication to mitigate escalating risks.
In October 2026, researchers using OpenAI's GPT-5.6 Sol model to assist in vulnerability analysis identified two critical PHP security flaws, tracked as CVE-2026-109618 and CVE-2026-109619. These vulnerabilities enable remote code execution on servers running PHP, which underpins approximately 70% of websites worldwide, including WordPress, Wikipedia, Etsy, and Yahoo.
Both flaws received a high severity rating of 9.2 out of 10. After public disclosure on October 21, 2026, the PHP Foundation promptly issued security patches for supported versions. However, legacy PHP releases still lack fixes, leaving segments of the web exposed.
Cloudflare reported a rapid surge in attack attempts exploiting these vulnerabilities, increasing from thousands to millions shortly after the alert. Despite this spike, successful breaches remain uncommon as many AI-generated exploit attempts failed to gain traction.
Cybersecurity specialists, including OpenAI CEO Sam Altman, emphasize the critical need for fast detection and layered defense. Altman stated, "I no longer think we’re going to be able to patch all bugs," highlighting rising challenges in securing software increasingly impacted by AI-driven research and attack methods. Experts recommend enforcing multifactor authentication and comprehensive patching strategies to mitigate risks.
The dual role of AI—as a tool for uncovering vulnerabilities and aiding attackers—heightens legal and regulatory debates. These developments press legal professionals to update risk management frameworks and influence government policy regarding AI’s role in cybersecurity.
By the numbers:
- 70% — Percentage of websites running PHP, including major platforms.
- 9.2/10 — Severity score of the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619.
- October 21, 2026 — Date when PHP patches were released following public disclosure.
Yes, but: While AI accelerated vulnerability detection, the resulting exploit attempts largely failed, illustrating that AI use does not guarantee immediate widespread breaches.
What's next: Legal and regulatory bodies are expected to intensify scrutiny of AI’s cybersecurity role, potentially leading to updated compliance guidelines and oversight on AI use in security research.