Key points
- OpenAI researchers used GPT-5.6 Sol to find two critical PHP vulnerabilities with severity scores of 9.2.
- The PHP Foundation released emergency patches for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 on 21 October.
- Versions 8.1 and older will not receive official fixes for these specific issues, leaving them permanently exposed.
Attackers could exploit these flaws to take control of servers running PHP, a language that powers an estimated 70% of websites. According to Tom's Hardware, OpenAI researchers demonstrated working exploits for two vulnerabilities rated at a critical 9.2 severity. The company coordinated with maintainers and security agencies to address the issues after the discovery.
In plain English
The vulnerabilities exist in the core engine of PHP, which processes server-side code. The source material states that researchers demonstrated working exploits for these critical flaws. This means that if a website is running an unpatched version, the system is vulnerable to the attacks demonstrated by the researchers. The exact technical mechanism is not detailed, but the severity indicates a high risk to server integrity.
The background
Researchers from Calif, a partner in OpenAI’s Patch the Planet programme, began auditing PHP on 30 July 2026. They identified the first exploitable vulnerability on 11 August, with OpenAI researchers confirming it the same day. Wiz, another security firm, independently identified an additional vulnerability. The PHP Foundation had known about the underlying issue since 2024 but lacked a fix or exploitation method until now.
What changes now
The PHP Foundation released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 on 21 October. This release was moved forward from 22 October due to premature disclosures on 20 October. OpenAI states that every site using PHP should upgrade to these versions immediately. Versions 8.1 and older will not receive official fixes, meaning they remain vulnerable.
The attacker's path
Teams usually monitor for unpatched server-side scripting engines as a primary entry point. Check whether your infrastructure relies on legacy versions that no longer receive security updates. Assess exposure by verifying that all web applications are running the latest supported releases. Ensure that automated deployment pipelines include security checks before code reaches production environments.
What to do and how to stay safe: PHP
- Audit all servers to identify which PHP versions are currently installed and in use.
- Prioritise upgrading any instances running versions 8.2 through 8.5 to the latest patched releases.
- Plan for migration away from PHP 8.1 and older, as these will not receive fixes for this issue.
- Monitor vendor announcements for any additional guidance or emergency updates from the PHP Foundation.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which PHP versions are affected by these new vulnerabilities?
Versions 8.2, 8.3, 8.4, and 8.5 are affected, but patches are now available. Versions 8.1 and older are also affected but will not receive fixes.
How were these vulnerabilities discovered?
OpenAI researchers used its AI model GPT-5.6 Sol to uncover the flaws as part of the Patch the Planet cybersecurity initiative.
When were the patches released?
The PHP Foundation released the patched versions on 21 October, moving the schedule forward due to premature disclosures.
