The PHP2Shell Story: 22 Years Of Context And AI-Assisted Review

🔍 Read the full analysis: The PHP2Shell Story: 22 Years Of Context And AI-Assisted Review on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on office and shipping supplies

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

PHP shipped fixes on October 21, 2026, for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. The findings were credited to Calif, OpenAI and Wiz, whose researchers used AI-assisted review; Calif’s account links the vulnerabilities to a longstanding class of risks involving requests interrupted during memory-limit handling.

Calif’s account describes research into PHP’s handling of out-of-memory (OOM) conditions, in which a request reaches its memory limit and PHP terminates it. If interruption occurs while the runtime is partway through an operation, partially created state may remain for cleanup code to handle. The 2004 advisory discussed in Calif’s retrospective warned that triggering termination at an unsafe point could, in some circumstances, allow remote code execution. PHP fixed the specific paths reported then, but the broader problem of interruption at unsafe moments remained a research concern.

The supplied timeline says Calif found several independent routes to remote code execution on August 1, 2026. Researcher Ryan Austin published a hash of one finding on August 5, then reported the first bug to PHP on August 11 and supplied a working proof of concept on August 14. PHP confirmed it the next day, according to the account. Calif reported a second bug on August 21. These dates and descriptions come from Calif’s timeline; the material provided here does not include PHP’s full technical advisories.

Wiz Research worked independently, according to its disclosure account. It says it found its first PHP vulnerability on August 19, validated unauthenticated code execution against Drupal on August 20 and WordPress on August 21, and reported the issue to PHP on August 24. Wiz described using its Wiz Atlas platform alongside Gemini 4 Argon and GPT-5.6 Sol. PHP’s October 21 fixes are the confirmed outcome in the supplied material; exact affected versions and upgrade instructions are not listed there.

Why PHP Runtime Security Matters

PHP powers software used across the web, including content-management systems such as WordPress and Drupal. Remote code execution flaws can matter because, if a vulnerable application and runtime are exposed to an applicable attack, an attacker may be able to run code on the affected server. Wiz’s account says it validated unauthenticated execution against those platforms, but that does not establish that every PHP installation or every site using them is vulnerable.

The research also offers a practical example of AI’s role in security work: models can assist a researcher’s investigation, while the researcher’s knowledge shapes where to look and how to test findings. Calif’s account emphasizes Austin’s familiarity with PHP’s history and his hypothesis about where old classes of bugs might persist. This is not evidence that AI tools can independently find all vulnerabilities, nor does the reported use of AI establish that the tools alone discovered or proved the flaws.

For maintainers and operators, the immediate issue is remediation: identify whether a deployment uses an affected PHP release and apply the relevant fix. The source material establishes that PHP shipped fixes, but does not provide the affected version range or confirm how widely the flaws were exploited. Those limits make official PHP advisories and vendor guidance essential for determining exposure.

From a 2004 Warning to PHP2Shell

The history in Calif’s account begins with Stefan Esser’s July 2004 advisory, “PHP memory_limit remote vulnerability,” posted to the Bugtraq mailing list under CAN-2004-0594. Esser warned that a remote attacker could trigger memory-limit termination at points where interruption was unsafe, potentially enabling code execution. PHP addressed the specific reported paths, but the episode established a security question about what happens when a request stops midway through an operation.

A later clue appeared in PHP bug #78876, filed on November 28, 2019. The report said that oversized multipart form fields could cause an out-of-memory failure and leave temporary upload files behind. PHP fixed the issue in May 2020; it was tracked as CVE-2019-11048 and described in the source as a denial-of-service risk because leftover files could fill disk space. Calif later interpreted the report as a possible clue to broader consequences of OOM handling, not as proof of the 2026 vulnerabilities.

Calif says the issue was encountered again during a 2024 PHP audit by Quarkslab, conducted with OSTIF and the PHP Foundation, but exploitation was not proven. OSTIF’s published summary lists 27 findings and four CVEs, all resolved, and does not mention an OOM issue. The claim that auditors rediscovered it comes from Calif, not the cited OSTIF summary. The distinction between an observed issue and a demonstrated exploit is central to this account’s chronology.

“possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe”

— Stefan Esser, in the July 2004 advisory quoted by Calif

Open Questions on Exposure and Scope

The supplied account does not identify the affected PHP versions, the precise technical differences between CVE-2026-109618 and CVE-2026-109619, or the full patches. It also does not establish whether either flaw was exploited in real-world attacks before the fixes shipped. Operators should consult PHP’s official security advisories and the guidance for any PHP-based software they run rather than infer exposure from the retrospective alone.

Some historical details remain attributed rather than independently established here. Calif says the 2024 audit encountered the OOM issue, but the OSTIF summary cited in the source does not mention it and the account says exploitation was not proven. Likewise, the timeline of the two 2026 research efforts comes from Calif and Wiz disclosures; the material provided does not contain a PHP statement confirming every date or describing the coordinated disclosure process in full.

The source describes the flaws collectively as PHP2Shell and says PHP fixed two critical remote code execution issues. It does not explain whether both vulnerabilities share the same root cause, whether all deployment configurations are affected, or what testing PHP performed before release. Those details may become clearer in the full advisories and subsequent technical analyses.

Check Advisories and Apply Fixes

PHP operators should check the official security notices for CVE-2026-109618 and CVE-2026-109619, compare their running versions with the affected and fixed releases, and apply the recommended update. Organizations that manage PHP through a hosting provider or software vendor should confirm when the fix is available for their particular deployment. The supplied source does not name a minimum fixed version, so it cannot support a version-specific upgrade instruction.

Further disclosures may clarify the vulnerabilities’ mechanics, affected configurations, and whether attackers used them before patching. PHP’s advisories and follow-up statements from the researchers are the key sources to watch. Until those details are available, the confirmed facts are narrower: two critical flaws were fixed on October 21, and researchers describe AI tools as part of investigations that drew on earlier PHP security history.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used in the supplied account for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, for which PHP shipped fixes on October 21, 2026.

Who found the vulnerabilities?

The account credits Calif and Wiz Research with separate research efforts and says OpenAI was involved through Patch the Planet and AI-assisted research. Calif and Wiz reported different discovery and disclosure timelines.

Did AI find the bugs by itself?

No such conclusion is established by the supplied material. Calif researcher Ryan Austin described using AI as part of a review guided by his knowledge of PHP, and cautioned that no model can find all bugs. Wiz also credited AI tools as contributors to its research and validation.

Should PHP users update their software?

Users should consult PHP’s official advisories to determine whether their version is affected and which fixed release to install. The source material confirms that fixes shipped but does not list affected versions or a specific upgrade target.

Is there evidence the flaws were exploited?

The supplied account does not confirm exploitation in real-world attacks. Wiz says it validated unauthenticated code execution against Drupal and WordPress during research; that is not evidence that attackers used the flaws against live sites.

Source: ThorstenMeyerAI.com