{"slug": "phps-flaws-show-the-stakes-of-ais-cyber-race", "title": "PHP’s flaws show the stakes of AI’s cyber race", "summary": "OpenAI disclosed that researchers and security experts using its GPT-5.6 Sol model identified two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let attackers remotely execute code and access sensitive data on servers running a language used by an estimated 70% of websites with an identifiable server-side language. OpenAI said it spent two months coordinating with PHP maintainers, Wiz, Cloudflare and government agencies under its Patch the Planet initiative before PHP released patches on Wednesday and the FBI Cyber Division urged organizations to update immediately or take unpatched systems offline. ThreatLocker CEO Danny Jenkins told The Deep View that vulnerability discovery is accelerating, with nearly 38,000 CVEs published in the third quarter of 2026, up 81% from the previous quarter.", "body_md": "penAI agents may have dug up one of the most widespread cyber vulnerabilities yet.\n\nOn Wednesday, the AI lab revealed that a group of researchers and security experts used GPT-5.6 Sol to identify critical vulnerabilities in PHP, an open-source programming language that is used by an [estimated 70% of all websites](https://w3techs.com/technologies/comparison/pl-js%2Cpl-PHP) where server-side language can be identified. OpenAI called the flaws \"one of the most impactful vulnerabilities in recent memory,\" highlighting that AI can be used to uncover internet-scale vulnerabilities that can arm both defenders and attackers.\n\n\"To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a [Defender’s Window](https://openai.com/index/the-defenders-window/) for maintainers and security providers to prepare fixes and protections ahead of disclosure,\" OpenAI said in its post.\n\nThe vulnerabilities, called CVE-2026-109618 and CVE-2026-109619, could enable hackers to remotely execute code on servers and gain access to sensitive data. OpenAI said it spent two months coordinating with maintainers of PHP, as well as Wiz, Cloudflare and government agencies to develop patches as part of its Patch the Planet initiative, before disclosing the vulnerabilities.\n\nPHP today [released security patches](https://www.php.net/archive/2026.php#2026-10-21-5) for the vulnerabilities, noting that all users are \"strongly encouraged to update immediately.\" [In a post on X](https://x.com/FBICyberDiv/status/2112921648252719420), the FBI Cyber Division urged organizations to immediately update the impacted PHP systems, or to take their systems offline if they cannot be patched quickly. Additionally, the agency warned organizations to monitor their servers for suspicious activity, and if they discover that their systems have been compromised, report it to their local FBI field office.\n\nThis incident underscores that AI is completely shifting what we consider to be exploitable, said Ismael Valenzuela, vice president of labs, threat research and intelligence at Arctic Wolf. Some vulnerabilities existed for longer than a decade, he said, living inside common applications like WordPress, WooCommerce and Magento. \"What changed wasn’t the underlying code, but the ability to find those weaknesses and turn them into working exploits,\" he said.\n\nAnd while this vulnerability impacts a large swathe of the internet, it's only the \"tip of the iceberg,\" Danny Jenkins, CEO of ThreatLocker, told The Deep View's Jason Hiner. Vulnerability discovery is already accelerating, he noted, with nearly [38,000 cybersecurity vulnerabilities](https://threatcluster.io/reports/q3-2026) published through the Common Vulnerabilities and Exposures program, or CVE, in the third quarter of this year, up 81% from the previous quarter.\n\n\"We're going to see more and more of it, and more and more sites are going to be exploited,\" said Jenkins. \"VPNs are going to be exploited. And I don't think it's stopping. I think it's accelerating, and will accelerate for at least two to three more years.\"\n\n## Our Deeper *View*\n\nDiscoveries like this are exactly why AI is a double-edged sword. The tech can be used as ammo both for security defenders and for threat actors, and the reality is that most organizations are woefully underprepared for the new reality. This is merely an example of just how large the threat surface is, and is precisely why security-by-obscurity, or just assuming your organization won't get targeted because it's obscure, is no longer an option when AI can automate not only vulnerability discovery, but exploits as well. It's also why access to these powerful models and the pace of development needs to be reigned in. Though OpenAI and Anthropic are trying their best to keep their most powerful systems under wraps, they are still largely forging ahead with frontier models, delivering several new and powerful updates to their flagship AI in recent months. But when every tool can be turned into a weapon, the onus is on the labs to prepare the world for the consequences of what their technology can unleash.", "url": "https://wpnews.pro/news/phps-flaws-show-the-stakes-of-ais-cyber-race", "canonical_source": "https://www.thedeepview.com/articles/php-s-flaws-show-the-stakes-of-ai-s-cyber-race", "published_at": "2026-10-21 21:17:25+00:00", "updated_at": "2026-10-21 22:40:39.858524+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "generative-ai"], "entities": ["OpenAI", "GPT-5.6 Sol", "PHP", "Wiz", "Cloudflare", "FBI Cyber Division", "Arctic Wolf", "ThreatLocker"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/phps-flaws-show-the-stakes-of-ais-cyber-race", "markdown": "https://wpnews.pro/news/phps-flaws-show-the-stakes-of-ais-cyber-race.md", "text": "https://wpnews.pro/news/phps-flaws-show-the-stakes-of-ais-cyber-race.txt", "jsonld": "https://wpnews.pro/news/phps-flaws-show-the-stakes-of-ais-cyber-race.jsonld"}}