The Long History Behind PHP2Shell And Its AI-Assisted Review

🔍 Read the full analysis: The Long History Behind PHP2Shell And Its AI-Assisted Review on ThorstenMeyerAI.com

Age 18–24?Offer from Amazon

Prime made for students and young adults

• Fast, free delivery for dorm and study essentials
• Prime Video and Amazon Music included
• Member-only deals

Try Prime for Young Adults →Free trial for eligible 18–24 year olds

As an affiliate, we earn on qualifying purchases.Hide

PHP shipped fixes on October 21, 2026, for two critical remote code execution vulnerabilities now known as PHP2Shell, following research by Calif and Wiz with AI tools assisting parts of the review. The finding connects to a security concern first raised in a 2004 advisory: what can happen when PHP runs out of memory while a request is in the middle of a sensitive operation.

The source account identifies the flaws as CVE-2026-109618 and CVE-2026-109619. Calif, OpenAI and Wiz receive research credit, while the PHP security team made the fixes. Calif’s account says its researchers found several independent paths to remote code execution on August 1, 2026. It reported its first bug to PHP on August 11, shared a proof of concept on August 14, and says PHP confirmed the report the next day. Calif reported a second bug on August 21.

Wiz Research worked separately, according to its disclosure post, finding a PHP vulnerability on August 19. The company says it confirmed unauthenticated code execution against Drupal on August 20 and WordPress on August 21, then reported the issue to PHP on August 24. The supplied account describes the teams as reaching the same class of flaw within weeks; it does not provide enough technical detail to independently compare their findings or establish precisely how the two CVEs relate to each other.

The research used AI-assisted tools, but the account also emphasizes human direction. Calif researcher Ryan Austin selected a target he knew and used prior vulnerability history to guide the search. OpenAI says Calif used GPT-5.6 Sol through its Patch the Planet initiative. Wiz and Google’s security blog say Gemini 4 Argon contributed to finding the vulnerability, exploit development, attack detection and patch validation. These are attributed accounts of the tools’ role, not evidence that a model independently discovered or resolved the flaws.

Why PHP2Shell Reached Beyond PHP

PHP is widely used to run websites and web applications, so remote code execution flaws in its runtime can matter beyond PHP’s own project. The supplied account says researchers demonstrated unauthenticated code execution against Drupal and WordPress; that makes the finding relevant to operators of PHP-based services, not only language developers. The account does not establish how many deployed systems were vulnerable or whether attackers exploited the issues before the fixes.

The history also offers a more measured account of AI-assisted security research. AI tools helped researchers examine a high-impact codebase, but the search was shaped by knowledge of older reports and a human-generated theory about where to look. That distinction matters as software teams consider AI tools: their contribution can accelerate review, while expertise remains important for selecting targets, interpreting results and confirming findings.

For administrators, the immediate consequence is practical: check the PHP security release information and apply the relevant fixes to affected installations. The supplied material does not specify fixed version numbers or provide enough technical detail to determine exposure for a particular configuration, so operators should consult PHP’s official advisories rather than infer applicability from the broader narrative.

From the 2004 Advisory to 2026

The reported history begins in July 2004, when Stefan Esser of e-matters published Advisory 11/2004, “PHP memory_limit remote vulnerability,” on the Bugtraq mailing list. The advisory said an attacker could trigger memory-limit termination at a point where interruption was unsafe, potentially enabling code execution. PHP fixed the specific paths Esser reported, though the source account says the broader problem of interruption at a vulnerable moment remained difficult.

A later clue appeared in PHP bug #78876, filed November 28, 2019. It described large multipart form fields causing an out-of-memory condition and leaving temporary upload files behind. PHP fixed the issue in May 2020, and it was assigned CVE-2019-11048. At that time, the reported impact was denial of service through disk space being consumed by leftover files—not the remote code execution described in the 2026 findings.

In 2024, Quarkslab audited PHP with OSTIF and the PHP Foundation. The published results listed 27 findings and four CVEs, all described as resolved. Calif later said auditors had rediscovered the out-of-memory issue, but exploitation was not proven and the bug was not fixed at that point. OSTIF’s summary, as described in the source, does not mention that issue. The difference between the public summary and Calif’s account should be kept clear: an unproven finding is not the same as a demonstrated exploit, and the available material does not resolve the discrepancy.

““No model is simply capable of unearthing ‘all bugs’.””

— Ryan Austin, Calif researcher, in Calif’s write-up

What the Public Record Leaves Open

The supplied material does not include the full PHP advisories, affected version ranges, patch details or a technical analysis of either CVE. It also does not say whether the vulnerabilities were exploited in the wild, how many systems were exposed, or whether the two CVEs represent distinct attack paths or related issues. Those questions should not be answered by inference from the researchers’ discovery timeline.

There is also a difference between Calif’s description of the 2024 audit and the contents of OSTIF’s published summary, as characterized by the source. The source does not provide the underlying audit finding or enough information to independently assess why the issue was not fixed then. Claims about AI contributions likewise come from the participating organizations; the supplied material gives no comparative measurement of what the models contributed relative to the researchers.

Patch Deployment and Disclosure Details

The immediate next step for PHP users is to consult the official PHP security release notes, identify whether their deployed version is affected, and install the applicable fixed release. The source account notes that a separate patch-and-restart guide is available, but it does not state version numbers or patch commands. Service operators should verify their own runtime and application dependencies rather than assume that a particular product label alone establishes exposure.

Further clarity depends on technical disclosures from PHP and the researchers, including affected versions, the exact relationship between the CVEs, and any evidence of exploitation. Additional information could also clarify how the 2024 audit finding relates to the later vulnerabilities. Until those details are available in the cited material, the confirmed development is that PHP shipped fixes on October 21 and the research teams reported AI-assisted work leading to the findings.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, for which PHP shipped fixes on October 21, 2026. The supplied source does not include the technical advisories or affected version ranges.

Did AI independently discover the PHP vulnerabilities?

The source does not support that conclusion. Calif researcher Ryan Austin says he chose a familiar target and guided the search using prior vulnerability knowledge. OpenAI and Wiz describe AI tools as assisting parts of their respective research; the extent of each tool’s contribution has not been independently measured in the supplied material.

What does the 2004 advisory have to do with the 2026 flaws?

The 2004 advisory raised a concern about PHP stopping a request because of its memory limit at an unsafe point in an operation. The 2026 account presents that history, along with a 2019 memory-related bug report, as context for later research. It does not provide enough technical detail to say the 2026 flaws are identical to the earlier issue.

Were PHP2Shell vulnerabilities exploited in the wild?

The source material does not say whether attackers exploited either vulnerability before the fixes. It describes researchers demonstrating remote code execution, including against Drupal and WordPress in Wiz’s account, but that is not evidence of real-world attacks.

What should PHP operators do?

Operators should check PHP’s official security advisories for affected versions and install the appropriate fixed release. The source supplied here does not list version numbers, so administrators should confirm applicability against PHP’s release information and their own deployments.

Source: ThorstenMeyerAI.com