The phrase "when it rains, it pours" applies both to weather and computer security, as proven the week of October 19, 2026, when OpenAI's GPT 5.6-Sol discovered critical vulnerabilities in the open-source programming language PHP. As published in a post-mortem, a small team of maintainers knew of the issue two years ago. Security experts had warned for decades about mounting technical debt, as agentic AI exponentially sped up vulnerability scanning, to the point that the usual 90-day disclosure window for security exploits became pointless. PHP, one of the internet's ubiquitous software packages, was unlucky enough to in the crosshairs of bug-hunting AI agents.

PHP hosts around 70% of websites on the internet, and the vulnerability allows for remote code execution with enough attacker knowledge. That combination is enough to sound alarms, but the situation got worse once the collective internet realized that, at the time, 73% of PHP installations online were running end-of-life versions with no active support — eliciting face-palms from many techies, and an exasperated sigh from anyone familiar with the ecosystem, myself included. So ultimately the problem wasn't really the vulnerability, but the general complacency.

The root cause of the vulnerability was an ancient architectural decision in the PHP engine's error handling. When a PHP process runs out of memory, it'll call the longjmp() C function, which means "immediately jump the execution to another place, no questions asked." Using longjmp() without a very good reason is generally unadvisable, though that by itself wasn't the problem.

The real issue is that if that jump happens while building a data structure (like adding an array entry, or initializing an object), that half-baked data remains in the memory heap.

Source link