AI Helped Find Critical PHP Flaws. Here’s What Website Owners Should Check

If your website runs on WordPress or another PHP application, this article deserves a closer look. OpenAI has described a coordinated response to critical PHP vulnerabilities, and the PHP project has released fixes. The immediate question for a site owner is whether the PHP environment actually serving their website has been patched.

What happened

According to OpenAI, security researchers at Calif used GPT‑5.6 Sol to identify a critical flaw through the Patch the Planet initiative. Wiz independently discovered and reported both vulnerabilities. PHP’s maintainers led the fixes, with OpenAI and other partners contributing research, technical support and coordination.

The disclosure concerns PHP. It does not report a breach of OpenAI’s systems, and PHP’s popularity tells us nothing about how many sites have been compromised. Determining whether a particular website has been attacked requires a separate investigation.

Why a plugin update is not enough

The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution. Both were rated 9.2 under CVSS v4.0. In practical terms, successful exploitation could let an attacker run code with the web worker’s privileges without first logging into the website. That does not automatically grant the server’s highest privileges.

One flaw concerns how PHP handles out-of-memory conditions; the other involves internal state that is not safely cleared between requests. These are problems in PHP itself. Updating a WordPress plugin alone does not replace the affected runtime.

PHP’s advisory covers installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The project considers mod_php the highest-risk setup. The precise attack paths depend on the runtime, configuration and application, so using FPM should not be treated as an automatic exemption.

The fixes are available

The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Sites on those branches should obtain the appropriate update through PHP or their operating-system vendor’s supported process.

An installed update still needs to reach the PHP processes serving your visitors. A server can contain more than one PHP environment. The version shown in a terminal may not be the one handling web traffic, and installing a package is not proof that existing workers have switched to it. Follow the provider’s restart or deployment procedure, then verify the runtime serving the site.

On managed hosting, ask a specific question: have both CVEs been fixed for my website, and is the patched runtime now active? That is more useful than simply asking whether the server is “up to date.”

Older installations need a little more care. PHP 8.1 and earlier no longer receive regular support from the PHP project, but some distributions and long-term-support vendors backport security fixes. The PHP security team has also provided limited source backports for 7.4, 8.0 and 8.1 in this case, without restoring regular support. Ask your provider to confirm the package or source-patch route rather than judging safety by the upstream version number alone. If no usable fix is available for your platform, prioritize a move to a supported release.

Treat this as urgent maintenance, not a blind upgrade

Our recommendation is to prioritize the patch while keeping a recovery path. Have usable file and database backups, check important extensions and application compatibility, and verify the functions your business depends on after deployment. For an online store that might mean checkout; for a publication it might be sign-in, forms and publishing. These checks should make an urgent update safer, not turn into a reason to postpone it indefinitely.

PHP also documents temporary mitigations, but says they do not make an installation fully safe. Configuration changes can affect uploads, memory use or availability. If an immediate upgrade is not possible, ask the hosting provider or administrator to assess the options for that environment and agree on a patch plan. A configuration change that helps one deployment may disrupt another, so these measures need to be chosen with care.

OpenAI says a companion Codex checking skill is still to come. There is no reason to wait for it before checking your hosting environment.

AI’s role in finding the flaws makes this a striking story. For website owners, the next step is more familiar: getting a verified fix onto the systems serving their visitors. If you are unsure whether your site depends on PHP, check the technology used by its backend and related services. This advisory does not mean every website is affected.

This article reflects public advisories available on October 21, 2026. We have not tested individual websites for these vulnerabilities.