PHP2Shell: A Long-Running Story Gets An AI-Assisted Review

🔍 Read the full analysis: PHP2Shell: A Long-Running Story Gets An AI-Assisted Review on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP shipped fixes on Oct. 21, 2026, for two critical remote code execution vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619, in a disclosure story involving Calif, OpenAI and Wiz Research. The account published by Thorsten Meyer on Oct. 22 says AI tools assisted the researchers, but traces the underlying security concern to a 2004 warning about PHP requests interrupted while memory is being managed.

Meyer’s account describes two flaws in PHP that could allow remote code execution and says the PHP security team prepared fixes. It credits research to Calif, OpenAI and Wiz. The material does not provide the affected PHP versions, patch identifiers, or a full technical description of either vulnerability, so those details cannot be established from the account alone.

Calif’s timeline says it found several independent paths to remote code execution on Aug. 1, 2026, reported its first bug to PHP on Aug. 11, and sent a working proof of concept on Aug. 14. PHP confirmed that report the following day, and Calif reported a second bug on Aug. 21. Wiz Research says it found its first vulnerability on Aug. 19, validated unauthenticated code execution against Drupal and WordPress in the following days, and reported the issue to PHP on Aug. 24.

The two research efforts used AI systems as part of security review, according to the accounts cited by Meyer. Calif’s work is associated with OpenAI’s Patch the Planet initiative; Wiz says it used its Wiz Atlas platform alongside Gemini 4 Argon and GPT-5.6 Sol. The source describes these systems as research aids, not as autonomous security researchers. The security fixes themselves are credited to the PHP team.

Why PHP Runtime Security Matters

PHP runs a substantial amount of web infrastructure, and remote code execution flaws can matter because they may let an attacker run code on a server rather than merely cause a service interruption. The reported validation against Drupal and WordPress signals that the research touched applications built on PHP, although the source does not establish that all installations of either platform were vulnerable or compromised.

The account also illustrates a practical limit of AI-assisted security work: models can help explore a researcher’s theory, but the historical knowledge and judgment used to choose that theory remain human contributions. Calif researcher Ryan Austin is described as drawing on the language and vulnerability history of PHP. This is relevant to security teams weighing AI tools: the reported discovery does not show that a model independently found every flaw, nor that the approach will produce similar results on other software.

For PHP operators, the immediate consequence is operational rather than theoretical: review official PHP security guidance, identify whether deployed versions are affected, and apply the relevant fixes. The supplied account refers readers to a separate patch-and-restart guide, but does not reproduce its instructions or specify which supported releases received updates.

From a 2004 Warning to PHP2Shell

The history begins with a July 2004 advisory by Stefan Esser of e-matters, posted to the Bugtraq mailing list as Advisory 11/2004. Esser warned that an attacker could trigger PHP’s memory-limit termination at a point where interruption was unsafe. His advisory described possible remote code execution. PHP fixed the specific paths he reported, but the broader class of unsafe interruption remained a concern in later accounts.

A later clue appeared in PHP bug tracker report #78876, filed in November 2019. It described large multipart form fields causing an out-of-memory condition and temporary upload files not being cleaned up. PHP addressed the issue in May 2020; it received CVE-2019-11048 and was treated as a denial-of-service problem because leftover files could consume disk space. Calif’s retrospective says the incident prompted a further question about what else might remain after an out-of-memory failure.

Meyer also recounts a 2024 PHP audit by Quarkslab, OSTIF and the PHP Foundation. The published audit summary listed 27 findings and four CVEs, all resolved, but did not mention an out-of-memory issue. Calif says auditors encountered the issue again, while acknowledging that exploitation had not been proven. That reported history is distinct from the documented audit summary and should not be read as proof that the 2024 review established an exploitable remote-code-execution flaw.

“possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe”

— Stefan Esser, in his July 2004 advisory, as quoted by Meyer

Patch Scope and Exploitation Status

The supplied account does not identify which PHP versions are affected, list the patched releases, or explain whether the two CVEs have separate technical causes. It also does not state whether the flaws were exploited in real-world attacks, how many systems may have been exposed, or whether any incidents were linked to them. The report of successful code execution against Drupal and WordPress is attributed to Wiz’s research; it is not evidence that attackers compromised those services in production.

Some parts of the historical narrative rely on Calif’s account rather than details in the cited public audit summary. In particular, the claim that the 2024 audit rediscovered the out-of-memory issue is attributed to Calif, while the audit’s published summary, as described by Meyer, does not mention it. The source also ends mid-account of the disclosure, so it does not provide a complete chronology of coordination, publication, or the response from all parties.

What PHP Operators Should Check

PHP administrators should consult the PHP project’s official security announcements and release notes to determine whether their deployed versions are affected, then apply the corresponding updates and restart services as directed by official guidance. Teams should also check vendor advisories for PHP-based applications and hosting platforms; the source account does not supply a definitive affected-version list or replacement for those notices.

Further reporting may clarify the technical distinction between CVE-2026-109618 and CVE-2026-109619, the precise patch scope, and whether any exploitation has been observed outside controlled research. Until those details are available, the confirmed development is that PHP released fixes on Oct. 21 and the research involved separate Calif and Wiz investigations with AI tools in supporting roles.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used in the source account for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, for which PHP shipped fixes on Oct. 21, 2026.

Who found the PHP2Shell vulnerabilities?

The account credits research to Calif, OpenAI and Wiz Research. Calif and Wiz conducted separate investigations, while AI tools were used to assist parts of the research. The PHP security team is credited with the fixes.

Did AI find the vulnerabilities on its own?

The source does not support that conclusion. It describes AI systems as tools used by researchers and quotes Calif researcher Ryan Austin saying, “No model is simply capable of unearthing ‘all bugs’.”

Were PHP servers or websites attacked?

The supplied material does not report confirmed attacks in the wild. Wiz says its researchers validated unauthenticated code execution against Drupal and WordPress, but that is not the same as evidence that production sites were compromised.

How can PHP users find the right fix?

Check the official PHP security announcement and release notes for affected versions and applicable updates. The source account confirms fixes shipped but does not include the version-by-version patch scope.

Source: ThorstenMeyerAI.com