PHP2Shell And The 22-Year Search For Answers With AI-Assisted Review

🔍 Read the full analysis: PHP2Shell And The 22-Year Search For Answers With AI-Assisted Review on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get hardware and tech essentials delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP shipped fixes on October 21, 2026, for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, called PHP2Shell. The research credited to Calif and Wiz Research used AI tools as part of vulnerability discovery and review, while Calif’s account connects the bugs to a security concern documented in 2004. The development matters because PHP runs a large share of web applications, but the available source does not specify how many systems were exposed or whether the flaws were exploited before the fixes.

Calif’s timeline says its researcher, Ryan Austin, found several independent paths to remote code execution on August 1, 2026. He published a hash of one finding on August 5, a way to establish later that he had documented it without disclosing the vulnerability itself. Calif says it reported its first bug to PHP on August 11, supplied a working proof of concept on August 14, and received confirmation from PHP on August 15. It reported a second bug on August 21.

Wiz Research worked independently, according to its disclosure post. It says it found its first PHP vulnerability on August 19, then confirmed unauthenticated code execution against Drupal on August 20 and WordPress on August 21. Wiz reported the issue to PHP on August 24. The source says the teams found the same class of flaw within weeks, but does not provide enough technical detail to compare their findings or establish whether their reported vulnerabilities map one-to-one to the two CVEs.

The researchers used AI systems to support their work. OpenAI says Calif found a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative. Wiz’s disclosure identifies its Wiz Atlas platform and Gemini 4 Argon and GPT-5.6 Sol among the tools used. PHP’s security team made the fixes; the source gives October 21 as the release date but does not name affected PHP versions or reproduce the patch notes.

Why PHP’s Old Bug Trail Matters

PHP2Shell matters because the reported impact is remote code execution: an attacker may be able to run code on a vulnerable server. PHP is widely used in web applications, and the researchers’ tests involving Drupal and WordPress show why flaws in a shared runtime can matter beyond a single application. The supplied account does not establish how many deployments were vulnerable, so the scale of exposure remains unknown.

The account also offers a measured example of AI-assisted security research. The tools helped researchers examine code and develop or validate findings, but the source does not show that a model independently discovered the flaws. Calif’s method relied on a researcher with knowledge of PHP’s history to select a target and guide the investigation. That distinction matters as software teams evaluate claims about AI’s role in finding security bugs: human expertise and model assistance are presented as complementary, not interchangeable.

For PHP operators, the immediate significance is operational: the fixes are available, and systems running affected versions may need to be updated. The source points readers to a separate patch-and-restart guide but does not include version-specific remediation instructions here. Administrators should consult PHP’s official security information for their installed release rather than infer patch requirements from the research timeline.

From a 2004 Warning to PHP2Shell

The history in Calif’s account begins with Stefan Esser’s July 2004 advisory, “PHP memory_limit remote vulnerability,” posted to the Bugtraq mailing list as CAN-2004-0594. Esser warned that a remote attacker could trigger PHP’s memory-limit termination at a point where interrupting execution was unsafe, potentially allowing code execution. PHP fixed the specific paths described then, but Calif frames the broader issue—failure during an unsafe interruption—as a problem that proved harder to eliminate.

A later clue appeared in PHP bug #78876, filed on November 28, 2019. The report said unusually long multipart form fields could cause an out-of-memory failure and leave temporary upload files behind. PHP fixed the issue in May 2020; it was tracked as CVE-2019-11048 and treated as a denial-of-service problem because leftover files could consume disk space. Calif says this behavior prompted a wider question about what else might remain in an unsafe state after memory exhaustion.

Calif also says a 2024 audit rediscovered the out-of-memory issue, but that exploitation was not proven and the bug was not fixed then. The published audit summary cited in the source lists 27 findings and four CVEs, all resolved, and does not mention that issue. That difference between the audit’s public summary and Calif’s account should be kept clear: the claim about rediscovery and the unproven impact is attributed to Calif, not confirmed by the summary.

““possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe””

— Stefan Esser, in his 2004 PHP security advisory, as quoted by Calif

Exposure and Exploit Status Remain Unknown

The supplied source does not say which PHP versions were affected, how many servers remained vulnerable when the fixes shipped, or whether attackers exploited either flaw before disclosure. It also does not provide technical descriptions sufficient to explain the differences between CVE-2026-109618 and CVE-2026-109619, or to confirm how each research team’s findings relate to those identifiers.

Several parts of the longer history are attributed claims rather than independently established facts in the supplied material. In particular, Calif’s statement that the issue resurfaced during the 2024 audit is not reflected in the audit summary cited here. The source also ends partway through a description of OpenAI’s announcement about Wiz, so its full account of that announcement cannot be assessed. No conclusion about the flaws’ exploitation in the wild or the effectiveness of fixes across all deployments can be drawn from these materials.

Patch Status and Disclosure Details

The next practical step for PHP operators is to check the official PHP security advisories and release notes for the affected versions and apply the relevant fixes. The source says PHP shipped fixes on October 21, but does not list patched release numbers or specify whether additional configuration steps are required. Operators should confirm installation and restart requirements against PHP’s own guidance.

Further reporting would need to establish the affected version range, the technical relationship between the two CVEs, and whether any exploitation occurred before the disclosures. More detail from PHP, Calif, and Wiz could also clarify how their separate reports were coordinated and how AI systems contributed at each stage. Until that information is available, the confirmed development is the release of fixes following two research efforts—not a measured account of real-world compromise or the total number of systems at risk.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used for two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP shipped fixes on October 21, 2026.

Who found the vulnerabilities?

The source credits research to Calif and Wiz Research. Their work was conducted separately, and both teams used AI tools as part of their research processes.

Did AI discover PHP2Shell on its own?

The supplied accounts describe AI systems supporting researchers’ review and vulnerability work, not acting independently. Calif researcher Ryan Austin said, “No model is simply capable of unearthing ‘all bugs’,” and described choosing a target based on his knowledge of PHP and its history.

Were the flaws exploited before PHP released fixes?

The supplied source does not establish whether either flaw was exploited before the October 21 fixes. Pre-patch exploitation status is unknown based on the information provided.

What should PHP operators do?

Operators should check PHP’s official security advisories and release notes to identify affected versions and apply the matching fix. The supplied material does not list patched version numbers or detailed installation steps.

Source: ThorstenMeyerAI.com