penAI agents may have dug up one of the most widespread cyber vulnerabilities yet.
On Wednesday, the AI lab revealed that a group of researchers and security experts used GPT-5.6 Sol to identify critical vulnerabilities in PHP, an open-source programming language that is used by an estimated 70% of all websites where server-side language can be identified. OpenAI called the flaws "one of the most impactful vulnerabilities in recent memory," highlighting that AI can be used to uncover internet-scale vulnerabilities that can arm both defenders and attackers.
"To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender’s Window for maintainers and security providers to prepare fixes and protections ahead of disclosure," OpenAI said in its post.
The vulnerabilities, called CVE-2026-109618 and CVE-2026-109619, could enable hackers to remotely execute code on servers and gain access to sensitive data. OpenAI said it spent two months coordinating with maintainers of PHP, as well as Wiz, Cloudflare and government agencies to develop patches as part of its Patch the Planet initiative, before disclosing the vulnerabilities.
PHP today released security patches for the vulnerabilities, noting that all users are "strongly encouraged to update immediately." In a post on X, the FBI Cyber Division urged organizations to immediately update the impacted PHP systems, or to take their systems offline if they cannot be patched quickly. Additionally, the agency warned organizations to monitor their servers for suspicious activity, and if they discover that their systems have been compromised, report it to their local FBI field office.
This incident underscores that AI is completely shifting what we consider to be exploitable, said Ismael Valenzuela, vice president of labs, threat research and intelligence at Arctic Wolf. Some vulnerabilities existed for longer than a decade, he said, living inside common applications like WordPress, WooCommerce and Magento. "What changed wasn’t the underlying code, but the ability to find those weaknesses and turn them into working exploits," he said.
And while this vulnerability impacts a large swathe of the internet, it's only the "tip of the iceberg," Danny Jenkins, CEO of ThreatLocker, told The Deep View's Jason Hiner. Vulnerability discovery is already accelerating, he noted, with nearly 38,000 cybersecurity vulnerabilities published through the Common Vulnerabilities and Exposures program, or CVE, in the third quarter of this year, up 81% from the previous quarter.
"We're going to see more and more of it, and more and more sites are going to be exploited," said Jenkins. "VPNs are going to be exploited. And I don't think it's stopping. I think it's accelerating, and will accelerate for at least two to three more years."
Our Deeper View #
Discoveries like this are exactly why AI is a double-edged sword. The tech can be used as ammo both for security defenders and for threat actors, and the reality is that most organizations are woefully underprepared for the new reality. This is merely an example of just how large the threat surface is, and is precisely why security-by-obscurity, or just assuming your organization won't get targeted because it's obscure, is no longer an option when AI can automate not only vulnerability discovery, but exploits as well. It's also why access to these powerful models and the pace of development needs to be reigned in. Though OpenAI and Anthropic are trying their best to keep their most powerful systems under wraps, they are still largely forging ahead with frontier models, delivering several new and powerful updates to their flagship AI in recent months. But when every tool can be turned into a weapon, the onus is on the labs to prepare the world for the consequences of what their technology can unleash.