PHP2Shell’s 22-Year Road: How AI-Assisted Review Wrapped Up An Old Story

🔍 Read the full analysis: PHP2Shell’s 22-Year Road: How AI-Assisted Review Wrapped Up An Old Story on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get privacy and security gear delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP released fixes on October 21, 2026 for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. Calif and Wiz Research reported vulnerabilities after AI-assisted review of the widely used PHP runtime; the research account traces the underlying security concern to a 2004 advisory about requests being interrupted when memory limits are reached.

The flaws were reported by two research efforts working separately. According to Calif’s account, its researchers found several independent paths to remote code execution on August 1, 2026. Calif says it reported an initial bug to PHP on August 11, supplied a working proof of concept on August 14, received confirmation from PHP on August 15, and reported a second bug on August 21. It had published a hash of one finding on August 5, a way to establish the date of the discovery without disclosing the finding itself.

Wiz Research disclosed a separate discovery timeline, saying it found its first PHP vulnerability on August 19 and reported it to PHP on August 24. Wiz says it confirmed unauthenticated code execution against Drupal on August 20 and WordPress on August 21. The supplied source says PHP shipped fixes for both vulnerabilities on October 21. It does not provide affected PHP versions, patch identifiers, or technical details sufficient to independently assess the full scope of exposure.

The work involved AI tools, but the accounts also describe substantial human direction. OpenAI says Calif found a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative. Wiz and Google’s security blog credit Gemini 4 Argon with helping find the vulnerability, develop an exploit, detect attacks and validate the patch. Those are claims by the organizations involved; they do not establish that a model independently found or verified the bugs.

Why PHP’s Memory-Limit Flaws Matter

Remote code execution can allow an attacker to run code on a vulnerable server, making these flaws more consequential than a crash or resource-exhaustion bug. PHP is used across a large portion of the web, and Wiz’s reported tests against Drupal and WordPress illustrate why runtime vulnerabilities can matter to operators of applications built on top of it. The supplied source does not establish how many systems were vulnerable or whether attackers exploited the flaws in the wild.

The research also offers a grounded account of AI-assisted security work. The reported process was not simply a model searching without direction: Calif’s Ryan Austin chose a target he knew and drew on its history of security issues. That combination matters to defenders evaluating AI claims. Models can accelerate analysis, but the researchers’ knowledge, testing and disclosure work remain central to the account.

For PHP maintainers and site operators, the immediate practical implication is to review the PHP security release and apply the relevant fixes. The source points readers to a separate patch-and-restart guide, but does not specify patch commands or which deployments need action. Administrators should confirm applicability against PHP’s own release information and their installed version.

From a 2004 Advisory to PHP2Shell

In July 2004, Stefan Esser of e-matters published Bugtraq Advisory 11/2004, titled “PHP memory_limit remote vulnerability,” and associated with CAN-2004-0594. Esser warned that a remote attacker could trigger memory-limit termination at a point where interruption was unsafe, potentially allowing code execution. PHP fixed the specific paths he reported, according to the supplied account, but the broader challenge of interruption during incomplete setup remained relevant to later research.

A PHP bug report filed on November 28, 2019, described large multipart form fields causing an out-of-memory condition and leaving temporary files behind. PHP fixed the reported issue in May 2020; it received CVE-2019-11048 and was treated as a denial-of-service problem because leftover files could consume disk space. Calif later viewed that behavior as a clue to what else might remain in memory or cleanup paths when a request ran out of memory.

Calif says a 2024 audit by Quarkslab, conducted with OSTIF and the PHP Foundation, encountered the same out-of-memory issue, but exploitation was not proven. OSTIF’s public summary, as described in the source, does not mention that issue. That difference is relevant: the audit’s published findings and Calif’s account should not be treated as identical records. The PHP2Shell work turned the older concern into reported remote-execution flaws and a patch release.

““possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe””

— Stefan Esser, in the July 2004 advisory as quoted in the supplied source

What the Disclosures Leave Open

The supplied material does not identify affected PHP versions, give technical descriptions of both flaws, or link each vulnerability to a specific product release. It also does not say whether the vulnerabilities were exploited before the fixes became available, how many servers were exposed, or whether any incidents have been confirmed. No independent technical advisory or complete patch notes are included here.

Some parts of the chronology are attributed to Calif or Wiz rather than presented as independently verified findings. In particular, Calif’s account says the 2024 auditors saw the earlier out-of-memory issue but did not prove exploitation; OSTIF’s summary reportedly omits it. The source also does not provide the complete disclosure material from OpenAI or the PHP security team, so the precise division of work between researchers and tools cannot be established from this account alone.

Patch Verification and Disclosure Details

PHP operators should check the official security release and determine whether their installed versions require an update, then follow their organization’s testing and deployment procedures. The supplied account says fixes shipped October 21, 2026, but does not name the fixed versions or provide a timetable for additional technical disclosures. Those details should be checked against PHP’s release notices rather than inferred from the research timeline.

Further reporting may clarify the affected version range, the relationship between the two CVEs, and whether investigators found evidence of exploitation. Until those details are available, the confirmed development is the release of fixes and the researchers’ reported discoveries; the broader reach and real-world impact of PHP2Shell remain unsettled.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, for which PHP shipped fixes on October 21, 2026.

Who found the vulnerabilities?

The supplied source credits Calif and Wiz Research with separate research efforts. OpenAI says Calif used GPT-5.6 Sol, while Wiz says its work involved Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol.

Were the flaws exploited in real attacks?

The source does not say whether either vulnerability was exploited in the wild. Confirmed exploitation is not established by the material provided.

What should PHP users do?

Check PHP’s official security release to see whether the installed version is affected and apply the relevant fix. The supplied source does not list affected versions, so operators should verify that information with PHP’s release documentation.

Why does the story reach back to 2004?

A 2004 advisory warned that memory-limit termination could occur at an unsafe point during a request. Later reports and research revisited related out-of-memory behavior, though the source does not establish that every issue in the timeline was the same vulnerability.

Source: ThorstenMeyerAI.com