PHP runs major web platforms including WordPress, Joomla, Drupal and Wikipedia’s MediaWiki. In a coordinated response, OpenAI worked with maintainers, researchers and security providers to address critical vulnerabilities in the language. Wiz Research says PHP underpins about 70% of websites worldwide.
Frontier AI helped researchers uncover core PHP flaws that affect versions dating back to 5.4.
Wiz reported two vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2. The reported issues include memory disclosure and unauthenticated remote code execution in PHP’s core engine, independent of the application running on top of it, according to Wiz Research.
OpenAI credits GPT-5.6 Sol in PHP vulnerability discovery
OpenAI’s coordinated-disclosure account says GPT-5.6 Sol identified a critical flaw as part of its Patch the Planet initiative. Wiz independently discovered and reported both vulnerabilities. OpenAI describes the response as a coalition of maintainers, researchers and security providers, and calls the flaws among the most impactful security issues in recent memory given their severity and PHP’s reach.
The two vulnerability classes are out-of-memory corruption and stale global state across requests. Wiz says successful exploitation could let attackers take control of affected servers, steal sensitive data or deface websites. Because the vulnerable code is in PHP itself, application-level safeguards alone do not establish that a site is safe. The report says even a simple “Hello World” application running on an affected PHP version could be exposed.
The public record does not show that GPT-5.6 Sol independently produced a complete exploit. It does credit the model with identifying a critical flaw, while Wiz reports that frontier AI substantially reduced the barrier to exploiting longstanding weaknesses. Discovery, exploit development and real-world abuse remain distinct steps.
AI joins fuzzing and pattern matching in PHP security research
The available sources do not describe GPT-5.6 Sol’s precise analysis process. They support a narrower account: AI can help researchers examine code and make longstanding flaws more practical to investigate. The PHP findings involve distinct classes, including memory disclosure and stale global state. That is evidence of what was found, not enough detail to claim a particular model technique caused each result.
Automation in PHP security research predates this disclosure. FIXX, a system designed to find similar exploits from examples, was evaluated against 32 CVE reports involving 19 PHP applications. It identified 1,097 similar exploitable paths and led to 10 new CVE entries, according to the FIXX research paper. The researchers designed it to help developers find instances of a known exploit pattern elsewhere in a program.
A separate tool, Phuzz, applies coverage-guided fuzzing to PHP web applications. Fuzzers exercise software with varied inputs while tracking the code paths reached. In tests of more than 1,000 API endpoints across the 115 most popular WordPress plugins, Phuzz found over 20 security issues and two new CVE IDs, its research paper reports.
FIXX and Phuzz demonstrate that automation can extend searches across paths and endpoints. They do not show that every finding is exploitable, or that expert review is unnecessary. The PHP disclosure adds a different signal: frontier AI can help surface a critical weakness in a widely used core engine.
PHP versions back to 5.4 are affected
Wiz says every PHP version released in the last decade is affected by at least one of the vulnerabilities, with exposure reaching back to version 5.4. That establishes a broad version range, not the number of websites still running vulnerable releases. A site’s exposure depends on the PHP version it uses and whether it has received the relevant fix.
The distinction matters for security teams. Reviewing a plugin or application does not answer which PHP engine supports it. Inventory and patch status are the immediate operational questions. The ledger provides no deployment-wide count, so claims that every PHP-powered site remains vulnerable would go beyond the evidence.
AI could move routine security testing toward continuous coverage
The practical change is the cost of searching. Human review is constrained by specialist time; automated methods can check more paths or endpoints and repeat a search against known patterns. FIXX’s results illustrate the leverage: a set of 32 CVE reports became a search for similar paths across 19 applications. The PHP case suggests frontier AI can also help researchers tackle flaws that had remained difficult to exploit.
More findings do not automatically mean more successful attacks. Each result still needs validation, and a fix must reach affected systems. But the wider the search, the more pressure falls on maintainers and operators to identify which software they run, prioritize credible findings and deploy updates promptly. Discovery can scale faster than remediation, leaving organizational response time as a possible bottleneck.
My forecast is that by October 2028, enterprises will shift a meaningful share of routine security-testing budgets from periodic manual reviews to continuous automated testing and monitoring. Manual penetration testing will remain valuable for validating findings and assessing complex systems. The likely change is a division of labor: machines handle repeated, broad searches; human specialists investigate context, verify impact and guide remediation.
The causal chain is straightforward but not guaranteed. AI-assisted analysis and automated testing can lower the cost of examining code. More economical searches can increase the volume of findings and shorten the interval between checks. If security teams cannot expand their capacity at the same rate, they will have an incentive to automate triage and monitoring as well as discovery. That would make continuous coverage a budget response to a growing workload, rather than a claim that machines can replace security judgment.
There is a counterargument: faster discovery does not prove faster exploitation, and existing techniques such as fuzzing and pattern matching already help locate weaknesses. A rapid, well-coordinated patch can reduce exposure. Automated tools can also generate findings that require substantial validation. Those limits could keep periodic human-led testing central, especially where organizations lack the systems or staff to act on continuous alerts.
The forecast is falsifiable. If by October 2028 enterprises have not moved material spending toward continuous automated testing and monitoring, while scheduled manual testing remains their primary approach, the prediction will have failed. If spending does move, the evidence should appear in procurement and operating practice, not just vendor claims.
Core PHP vulnerabilities make runtime inventory essential
These CVEs expose a risk beneath application-level security: a vulnerable language runtime can affect the applications running on it. Operators need to identify their PHP versions and verify that fixes have reached their systems. For maintainers, the challenge is broader than handling one report; it includes determining where affected components are deployed and tracing updates through dependent software.
AI may lower the cost of finding weaknesses, but it does not deploy patches. Organizations still need to validate findings, prioritize systems and complete remediation. The gap between disclosure and a working update remains a human and operational problem, even when discovery is automated.
PHP’s reach makes that gap consequential. The same ecosystem that supports major publishing platforms and websites now faces scrutiny that can be widened by AI-assisted research. The security standard is moving toward continuous examination, but protection still depends on getting the fix onto the server.
