Inside The 22-Year Road To PHP2Shell And Its AI-Assisted Review

🔍 Read the full analysis: Inside The 22-Year Road To PHP2Shell And Its AI-Assisted Review on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP shipped fixes on October 21, 2026, for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, described in the source account as PHP2Shell. Research credited to Calif, OpenAI and Wiz brought renewed attention to an older PHP memory-handling problem, while researchers also used AI tools during parts of the review. The development matters because PHP is used across a large share of the web, but the available account does not establish that AI independently discovered the flaws or that every claimed attack scenario has been independently verified.

The source account says the vulnerabilities were fixed by the PHP security team. It describes Calif researcher Ryan Austin as tracing the issue through PHP’s history and using a theory about memory-limit interruptions to guide review. OpenAI said Calif found a critical flaw using GPT-5.6 Sol as part of its Patch the Planet initiative. Calif’s account says no special harness or models beyond those generally available were used; those descriptions are attributed accounts, not an independent assessment of the model’s contribution.

Calif’s timeline says it found several paths to remote code execution on August 1, 2026, reported one issue to PHP on August 11 and supplied a proof of concept on August 14. PHP confirmed it the following day, according to the account. Calif reported a second bug on August 21. Separately, Wiz Research says it found a PHP vulnerability on August 19 using its Wiz Atlas platform alongside Gemini 4 Argon and GPT-5.6 Sol, then tested unauthenticated code execution against Drupal and WordPress before reporting to PHP on August 24.

The supplied material says PHP’s October 21 release addressed both CVEs, but it does not include release-note details, affected version ranges, patch identifiers or a technical description of the vulnerable code paths. Readers who maintain PHP systems should consult the official PHP security advisories and version-specific release information before deciding which systems are affected.

Why PHP Memory Handling Matters

The story joins a long-running software security question with current debate about AI-assisted vulnerability research. PHP’s memory limit is intended to stop requests that consume too much memory. The historical concern described by Calif is that an interruption at a poorly chosen point could leave a partially built structure for cleanup code to handle. If that state can be abused, a protective limit may contribute to a security flaw rather than simply ending a request.

Remote code execution can allow an attacker to make a vulnerable server run code, so the reported PHP fixes warrant attention from operators of affected systems. The supplied account does not specify the conditions required for exploitation or establish how widely PHP2Shell was exposed in deployed applications. It also cautions against treating the discovery as evidence that a model can find vulnerabilities unaided: human direction and historical knowledge were part of Calif’s described method.

From a 2004 Warning to PHP2Shell

The account traces the line of inquiry to July 2004, when Stefan Esser of e-matters published an advisory about PHP’s memory limit. Esser warned that a remote attacker might trigger request termination where interruption was unsafe, potentially enabling code execution. PHP fixed the specific paths discussed at that time, but the broader concern about interruptions during setup remained relevant to later research.

In November 2019, PHP bug tracker report #78876 described oversized multipart form fields causing out-of-memory errors and leaving temporary files behind. PHP fixed the issue in May 2020; it was assigned CVE-2019-11048 and treated as a denial-of-service problem. Calif’s account says the leftover files prompted researchers to ask what other state might persist after an out-of-memory event. It also says a 2024 audit rediscovered the issue but did not prove exploitation. The audit’s published summary, according to the source material, does not mention that finding, so the two accounts should not be treated as identical records.

Calif joined OpenAI’s Patch the Planet effort in 2026, according to the account, and worked with PHP Foundation involvement. Wiz says its researchers investigated in parallel and reached a related vulnerability class. The supplied excerpt ends while recounting the disclosure sequence, so it does not provide a complete account of coordination, severity ratings or the full technical relationship between the two CVEs.

Details Still Missing From the Record

The supplied material does not give the affected PHP versions, the precise technical mechanism for each CVE, or the conditions an attacker would need to meet. It also does not provide the official advisories or patch references needed to verify the release scope. Those details matter for determining exposure and whether a system has been corrected.

The account attributes discovery and testing milestones to Calif and Wiz, but does not include the complete underlying research papers, PHP’s response in full, or a joint disclosure record. The extent of each AI system’s contribution is also not quantified. Claims about testing against Drupal and WordPress are attributed to Wiz; the source material does not establish that all deployments of those applications are vulnerable or that the tests represent every possible configuration.

Check Advisories and Patch Status

PHP operators should check the official security advisories and release notes for CVE-2026-109618 and CVE-2026-109619, identify whether their installed versions are affected, and apply the relevant fixes. The supplied account says the PHP security team has shipped fixes, but does not identify the patched version numbers. Administrators should verify their deployed version against PHP’s own guidance rather than infer coverage from the vulnerability name alone.

Further technical detail may come from the researchers’ full disclosures and PHP’s advisories, including affected branches, patch references, exploitation requirements and any confirmed evidence of attacks. Until those materials are available in the record presented here, the reported timeline and AI contributions should remain attributed to the organisations and researchers that described them.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used in the supplied account for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, fixed by PHP on October 21, 2026.

Did AI discover the PHP vulnerabilities?

Calif and Wiz say AI tools contributed to their research. Calif’s account also describes a researcher selecting the target and guiding the investigation using historical knowledge. The available material does not show that a model independently found the flaws or quantify its contribution.

Which PHP versions are affected?

The supplied source does not list affected versions or patch numbers. Check PHP’s official advisories and release notes for the CVEs to identify the relevant versions and fixes.

Were the flaws exploited in real-world attacks?

The supplied material does not confirm real-world exploitation. It describes research testing, including Wiz’s reported tests against Drupal and WordPress, but does not establish attacks against deployed systems.

What should PHP administrators do now?

Review PHP’s official security guidance for CVE-2026-109618 and CVE-2026-109619, determine whether installed versions are affected, and apply the specified fixes. The source account does not include the version details needed to name a particular patch.

Source: ThorstenMeyerAI.com