OpenAI Claims GPT-5.6 Sol Helped Uncover Critical PHP Flaws Affecting 70% of Websites
OpenAI states its AI model assisted researchers in finding severe PHP vulnerabilities, leading to urgent patches.
According to a report by Tom's Hardware, OpenAI announced on October 21, 2026, that researchers participating in its "Patch the Planet" cybersecurity initiative used the GPT-5.6 Sol model to identify critical security vulnerabilities in PHP, an open-source programming language powering approximately 70% of the internet.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, involve flaws in PHP's memory management and error handling. OpenAI claims that while human developers had been aware of the underlying code issues since 2024, they were unable to determine an exploitation method or a fix until AI-assisted researchers demonstrated practical exploits within two weeks.
The PHP Foundation has released patched versions for PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, urging all sites using PHP to upgrade immediately. Older versions, including PHP 8.1 and below, will not receive official fixes.
This incident highlights OpenAI's "Defender's Window" concept, which argues that organizations should proactively use advanced AI models to strengthen defenses before malicious actors can exploit similar capabilities.