TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
PHP released fixes on Oct. 21, 2026, for two remote code execution flaws known as PHP2Shell. The account by Calif traces a related line of investigation from a 2004 warning about unsafe memory-limit interruptions through later bug reports, an audit and research by Calif, OpenAI and Wiz. The sources do not establish that every issue in that history had the same cause or that the 2004 vulnerability remained exploitable until 2026.
PHP released fixes on Oct. 21, 2026, for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. The findings, credited to Calif, OpenAI and Wiz, affect a runtime used by many websites; the researchers’ account traces the investigation to earlier reports about PHP handling memory exhaustion, including a 2004 warning, though the available material does not show that one unchanged flaw persisted for 22 years.
The PHP security team published PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct. 21, according to the supplied account. Both CVEs carry a CVSS v4.0 score of 9.2. Calif’s account says it reported two bugs to PHP in August: its first report was sent Aug. 11, a working proof of concept followed Aug. 14, and PHP confirmed the issue Aug. 15. Calif reported a second bug Aug. 21.
Wiz Research says it found a PHP flaw during work from Aug. 19 to 24 and reported it on Aug. 24. The account says Wiz used its Atlas platform with Gemini 4 Argon and GPT-5.6 Sol, and confirmed remote code execution in Drupal and WordPress. Those details are attributed to Wiz; the supplied material does not provide an independent technical assessment of the demonstrations or specify how the findings map to each CVE.
The story’s long timeline is about a class of risks involving interruption during memory exhaustion, not a documented single bug left untouched since 2004. A 2004 advisory warned that triggering PHP’s memory limit at an unsafe point could allow remote code execution. A 2019 bug report later described out-of-memory errors leaving upload-related temporary files behind; PHP fixed that issue in 2020 as CVE-2019-11048, then classified as denial of service.
Security Investigation · PHP Runtime
What Did It Take to Finish the PHP2Shell Story After 22 Years?
PHP patched two critical remote code execution flaws on October 21, 2026. Calif’s account traces the research through years of reports about memory exhaustion and unsafe interruption points. The history connects a class of risks; it does not prove one unchanged flaw lasted 22 years.
01 / At a glance
A long thread, not a proven 22-year bug
The account follows memory exhaustion behavior as researchers revisited what could happen when PHP stops work under pressure.
Remote code execution fixes
PHP released patches for CVE-2026-109618 and CVE-2026-109619. The supplied account does not specify affected configurations or confirmed attacks in the wild.
PHP runs server-side code
A remote code execution flaw can let an attacker run code on a vulnerable server. Actual exposure depends on conditions not detailed in the supplied material.
How the findings connect
The sources do not establish that the 2004 advisory, the 2019 report, the audit finding and the two 2026 CVEs are the same defect.
02 / From advisory to patch
Five moments in the investigation
Different reports described different impacts, from unsafe interruption to leftover files and later demonstrated code execution paths.
Memory-limit warning
Stefan Esser’s e-matters advisory warned that triggering memory-limit termination at an unsafe point could allow remote code execution. The account says PHP fixed the reported paths.
Upload cleanup report
Bug #78876 described out-of-memory errors leaving temporary files behind. PHP fixed it as CVE-2019-11048, then classified as denial of service.
Audit revisits the issue
Calif says an audit with OSTIF and the PHP Foundation encountered the memory issue, but did not prove exploitation. OSTIF’s published summary reportedly does not mention it.
New reports and research
Calif says it joined OpenAI’s Patch the Planet initiative July 30. Reports followed Aug. 11, 14, 15 and 21; Wiz says it found and reported a flaw Aug. 24.
PHP publishes fixes
PHP released patches for two critical RCE vulnerabilities across four listed release branches and publicly disclosed the CVEs.
03 / Original warnings
Two quotes, different evidence
The record shows how impact can be reassessed as researchers gain new evidence. It does not, by itself, establish a single continuous flaw.
“Possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe.”Stefan Esser · e-matters Advisory 11/2004
The advisory described remote code execution as a possible consequence of unsafe interruption.
“Exploitation was not proven, hence the bug was not fixed.”Calif · describing the 2024 audit
Calif says the audit rediscovered the out-of-memory issue but did not demonstrate exploitation at that time.
04 / Risk and response
What operators can act on now
The release versions are concrete. Exposure details and the relationship among historical reports need further technical documentation.
Check the running PHP branch
Administrators can compare installed versions with PHP’s security advisory and review updates for the branches named in the account. The listed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The supplied material gives no upgrade deadline, older-branch support details, or temporary mitigation guidance. It also gives no count of affected servers or attempted exploits.
05 / Research pathway
How the account connects the work
Research credit and demonstrations below are attributed to the supplied account; the material does not independently map every finding to a CVE.
Reports surface behavior
Earlier work described unsafe memory-limit interruption and out-of-memory cleanup problems.
Researchers revisit risk
Calif, OpenAI and Wiz are credited with research connected to the 2026 disclosure.
RCE paths described
Wiz says it confirmed remote code execution in Drupal and WordPress. The account provides no independent technical assessment.
PHP ships fixes
The PHP security team published patches for two high-scoring RCE CVEs on October 21, 2026.
06 / Key questions
What we know—and what is not established
These answers reflect the supplied account and its stated limits.
What is PHP2Shell?
The name used for two PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, patched October 21, 2026.
Did one flaw remain unfixed for 22 years?
The available material does not establish that. It links the research to an older class of concerns about memory-limit interruptions.
Have attackers exploited the flaws in the wild?
The supplied source material does not say whether either vulnerability has been used in real-world attacks.
Who receives research credit?
The account credits Calif, OpenAI and Wiz with research. PHP’s security team published the releases.
Why PHP’s Memory Handling Matters
PHP runs server-side code for websites and applications, so remote code execution flaws can matter well beyond a single deployment. The risk described here is that a remote attacker could cause code to run on a vulnerable server. The supplied material does not identify affected configurations, conditions for exploitation, or confirmed attacks in the wild, so the practical exposure for any one site cannot be determined from this account alone.
The chronology also shows how the impact assigned to a finding can change with evidence. The 2019 report was fixed as a denial-of-service issue because leftover temporary files could consume disk space. Calif says a 2024 audit encountered the same out-of-memory issue but did not prove exploitation. Later research reported remote code execution paths, leading to the 2026 fixes. That sequence illustrates the value of revisiting behavior when new analysis changes what researchers can demonstrate.
For operators, the immediate consequence is concrete: the relevant PHP branches have patch releases, and systems running those branches should be reviewed against the PHP advisory. The source material does not state how many servers are affected or provide a count of exploitation attempts.
As an affiliate, we earn on qualifying purchases.
From Advisory to Patch
In July 2004, security researcher Stefan Esser published e-matters Advisory 11/2004, titled “PHP memory_limit remote vulnerability.” The advisory said it was “possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe,” and described remote code execution as a possible consequence. The supplied account says PHP fixed the specific paths reported at the time. It does not establish that those exact paths are the ones fixed in 2026.
On Nov. 28, 2019, PHP’s bug tracker received report #78876 about long multipart form fields causing out-of-memory errors and leaving temporary files behind. PHP fixed it in May 2020 as CVE-2019-11048. Calif’s later write-up treats the report as a clue to broader cleanup behavior. In 2024, Quarkslab audited PHP with OSTIF and the PHP Foundation. Calif says auditors rediscovered the out-of-memory issue but could not prove exploitation. OSTIF’s published summary, as described in the source material, does not mention that issue.
Calif says it joined OpenAI’s Patch the Planet initiative on July 30, 2026, and brought the PHP Foundation into the work through Volker Dusch. Calif credits its research and write-up to Ryan Austin, with the accompanying comic story and poster by Michal Zalewski and illustrations by Stephanie Cortes of Ibis Craft. PHP’s security team made the releases; Calif, OpenAI and Wiz receive research credit in the supplied account.
““Possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe.””
— Stefan Esser, e-matters Advisory 11/2004
web application vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What the Timeline Does Not Prove
The source material does not establish that the 2004 vulnerability and the two 2026 CVEs are the same defect, or that a single exploitable flaw remained present for 22 years. It presents a connected research history around unsafe interruptions and memory exhaustion. The exact technical relationship among the 2004 advisory, bug #78876, the audit finding and PHP2Shell requires the underlying advisories and technical reports for confirmation.
It is also unclear from the supplied material which specific PHP configurations or request conditions are required to exploit each CVE, whether attackers have used either flaw, and how many systems remain unpatched. The account does not provide independent confirmation of Wiz’s Drupal and WordPress demonstrations or a detailed mapping of each research group’s finding to the two CVE identifiers.
remote code execution testing tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Patch Status and Disclosure
PHP’s Oct. 21 release provides patched versions for the 8.5, 8.4, 8.3 and 8.2 branches listed in the source. Administrators can compare their installed versions with the PHP security advisory and plan updates according to their deployment. The supplied account gives no deadline for upgrading, information about support for older branches, or details on mitigation where an upgrade cannot be applied immediately.
Further technical details may clarify the exploit conditions, affected configurations and relationship between the historic reports and the 2026 vulnerabilities. Until then, the confirmed development is that PHP released fixes and publicly disclosed two high-scoring remote code execution CVEs; the broader 22-year framing remains Calif’s account of how the investigation developed.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used for two PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which PHP patched on Oct. 21, 2026.
Which PHP versions received fixes?
The supplied account lists PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as released on Oct. 21, 2026.
Did one PHP flaw remain unfixed for 22 years?
The available material does not establish that. It links the 2026 research to an older class of concerns about memory-limit interruptions, but does not show that the 2004 vulnerability and the two 2026 CVEs are the same flaw.
Have attackers used PHP2Shell in the wild?
The supplied source material does not say whether either vulnerability has been exploited in real-world attacks.
Who is credited with the research?
The account credits Calif, OpenAI and Wiz with research and the PHP security team with the fixes. It attributes the detailed chronology and technical claims to the researchers and their reports.
Source: Thorsten Meyer AI
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
