OpenAI Assists in Discovery of Two Critical PHP Vulnerabilities; Official Patches Released
OpenAI's AI-assisted security research helped identify two CVSS 9.2 remote code execution vulnerabilities in PHP, which were patched on October 21.
U.S. AI company OpenAI disclosed that its participation in security research work assisted in discovering two critical security vulnerabilities in the open-source programming language PHP. These vulnerabilities allow attackers to execute code on affected servers without authentication under specific conditions. The PHP project released a security update on October 21, 2026, fixing these two vulnerabilities, which have a maximum score of 9.2.
The investigation was supported by Patch the Planet, an open-source software security initiative launched by OpenAI. According to disclosures by the PHP Foundation, security firm Calif initiated a PHP security audit on July 30, 2026, with technical and coordination support from OpenAI, Wiz, and Cloudflare. The two vulnerabilities, numbered CVE-2026-109618 and CVE-2026-109619, involve PHP's underlying memory management and error handling mechanisms. The first is related to memory corruption caused by out-of-memory (OOM) conditions, while the second involves stale global state and use-after-free issues.
Notably, the root causes of these vulnerabilities can be traced back to an external security audit in 2024. At that time, a core PHP developer discovered abnormal signs related to memory exhaustion but failed to find a clear method for remote code execution. It was not until August 11, 2026, that a Calif researcher reported an attack path capable of achieving remote code execution, and OpenAI independently reported the same root cause on the same day. This process demonstrates the potential of AI models in helping researchers uncover potential attack paths from known anomalies.
OpenAI refers to this phase as the "Defender's Window," where maintainers and security service providers have the opportunity to discover issues, develop patches, and prepare protective measures before attackers do. However, vulnerability discovery is only part of the entire security response process. The PHP Foundation noted that since July 1, 2026, the team has published 15 CVE-numbered vulnerability advisories while processing over 100 reports ultimately deemed invalid, duplicate, or unreproducible. As AI-assisted research increases, security teams need to invest more effort in screening reports, reproducing issues, and assessing risks.