🔍 Read the full analysis: The PHP2Shell Story, Reconsidered Through AI-Assisted Review on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
PHP released fixes on October 21, 2026, for two critical remote-code-execution vulnerabilities known as PHP2Shell. Calif and Wiz independently reported related flaws after AI-assisted reviews, while the longer history includes an older memory-limit issue; the precise relationship among all findings and the affected deployments is not fully detailed in the supplied account.
The research story spans two independent teams and a security concern first described in 2004. Calif’s account says researcher Ryan Austin found several independent routes to remote code execution on August 1, 2026. He reported a first bug to PHP on August 11, supplied a proof of concept on August 14, and received confirmation from PHP on August 15. Calif reported a second bug on August 21.
Wiz Research worked in parallel. Its disclosure post says it found its first PHP vulnerability on August 19, using its Wiz Atlas platform with Gemini 4 Argon and GPT-5.6 Sol. Wiz reported the issue to PHP on August 24. The supplied source says Wiz demonstrated unauthenticated code execution against Drupal and WordPress, but does not provide enough detail to establish which products or configurations are affected by each of the two PHP flaws.
PHP released the fixes on October 21. The research credit goes to Calif, OpenAI and Wiz, while the PHP security team made the fixes. The source describes Calif’s work as AI-assisted and says OpenAI identified GPT-5.6 Sol as part of its Patch the Planet initiative. It describes Wiz’s work as using its own platform and Google and OpenAI models. These are source-reported accounts; the supplied material does not include PHP’s advisory text or technical patch details.
Infographic 01 · Timeline
One class of bug, four chances to catch it.
The flaws fixed on 21 October 2026 continue a line that starts with a 2004 advisory about unsafe interruptions.
- Jul 2004Stefan Esser: memory_limit can stop PHP “where an interruption is unsafe”Advisory 11/2004, CAN-2004-0594. Remote code execution was possible. (e-matters)
- 28 Nov 2019Bug #78876: long upload fields cause out-of-memory, temp files left behindFixed May 2020 as CVE-2019-11048, a denial-of-service issue at the time. (PHP bug tracker)
- 2024Quarkslab audit with OSTIF and the PHP FoundationAccording to Calif, it rediscovered the same OOM issue; exploitation was not proven, so it stayed open. (Calif, OSTIF)
- 30 Jul 2026Calif joins OpenAI’s Patch the Planet and picks PHPStefan Esser brings in the PHP Foundation through Volker Dusch. (Calif)
- 1–21 Aug 2026Calif finds several RCE paths and reports two bugs to PHPFirst report 11 Aug, working proof of concept 14 Aug, confirmed by PHP 15 Aug, second report 21 Aug. (Calif)
- 19–24 Aug 2026Wiz Research finds its first PHP flaw and reports on 24 AugUsing Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol; RCE confirmed on Drupal and WordPress. (Wiz)
- 21 Oct 2026PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 releasedCVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2. Public disclosure the same day. (PHP)
“…possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe.”Stefan Esser, e-matters Advisory 11/2004
Sources: e-matters Advisory 11/2004; PHP bug #78876; OSTIF; Calif: php2shell; Wiz Research (21 Oct 2026); PHP security advisory (21 Oct 2026).
Powered by Thorsten Meyer AI
AI Helped Investigate PHP’s Longstanding Risks
PHP is used across a large share of the web, so a remotely exploitable flaw in the runtime can matter beyond a single application. The reports of code execution on Drupal and WordPress illustrate the potential reach, though the source does not specify the vulnerable versions, deployment conditions or exposure across installations. Operators should rely on PHP’s security guidance to determine whether their systems need an update.
The episode also offers a more qualified account of AI’s role in security research than the idea that models independently find every flaw. Calif’s approach, as described in its write-up, began with Austin’s knowledge of PHP and its vulnerability history. AI tools assisted the search; they did not replace the researcher’s choice of target or theory. That distinction matters as maintainers and security teams evaluate claims about automated vulnerability discovery.
PHP security vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From a 2004 Warning to PHP2Shell
In July 2004, security researcher Stefan Esser published an advisory warning that an attacker could trigger PHP’s memory-limit termination at a point where interruption was unsafe. The advisory said this could allow code execution on remote PHP servers. PHP fixed the specific paths he reported, but the source says the broader risk of interruption during an unsafe operation proved harder to eliminate.
A later clue appeared in PHP bug #78876, filed in November 2019. It reported that oversized multipart form fields could cause an out-of-memory failure and leave temporary upload files behind. PHP fixed the issue in May 2020; it received CVE-2019-11048 and was treated as a denial-of-service risk because leftover files could fill a disk.
Calif says a 2024 audit again encountered the out-of-memory issue, but exploitation was not proven. The published audit summary from OSTIF, as described in the source, lists 27 findings and four CVEs but does not mention that issue. The distinction between a rediscovered condition and a demonstrated exploit is central to the retrospective: the earlier reports provide context, but do not by themselves prove that the 2026 vulnerabilities were identical.
As an affiliate, we earn on qualifying purchases.
Affected Versions and Exploit Scope
The supplied account does not list the affected PHP versions, the exact patch versions, or the technical differences between CVE-2026-109618 and CVE-2026-109619. It also does not establish how widely the vulnerabilities were exposed in real-world deployments or whether attackers exploited them before fixes became available.
The relationship between the 2004 advisory, the 2019 out-of-memory report, the issue Calif says resurfaced in 2024, and the 2026 flaws is presented as a historical thread, not a claim that all were the same bug. The account also says Calif and Wiz found related vulnerabilities independently, but does not fully map each team’s findings to each CVE. PHP’s advisory and the teams’ full technical disclosures would be needed to answer those questions.
PHP code vulnerability detection tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Patch Guidance and Full Disclosures
PHP administrators should consult the official PHP security advisories and update to a fixed release that matches their supported branch. The source says PHP shipped fixes October 21, but does not name the versions or provide an upgrade procedure. Application operators should check their PHP runtime and hosting arrangements rather than assume that updating an application alone addresses a runtime flaw.
Further disclosures from PHP, Calif and Wiz may clarify affected versions, attack prerequisites, the mapping of findings to CVEs, and whether any exploitation has been observed. Until those details are available, the confirmed development is that PHP issued fixes for two critical remote-code-execution flaws—not that every PHP installation is vulnerable or that exploitation occurred.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used in the source account for two critical remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619, for which PHP shipped fixes on October 21, 2026.
Who found the PHP vulnerabilities?
The source credits Calif and Wiz Research with separate, AI-assisted research. It says Calif reported findings in August and Wiz independently reported a vulnerability later that month. The supplied account does not fully map each team’s work to each CVE.
Did AI discover PHP2Shell on its own?
The account does not support that conclusion. Calif researcher Ryan Austin chose a target and guided the search using knowledge of PHP’s history; AI tools assisted. Wiz also described using its platform alongside language models.
Are PHP systems known to have been exploited?
The supplied source does not confirm real-world exploitation. It reports demonstrations of unauthenticated code execution against Drupal and WordPress during Wiz’s research, which is not the same as evidence that attackers used the flaws.
What should PHP administrators do?
Check PHP’s official security advisories for affected and fixed versions, then update the runtime as directed. The source account does not include version-specific patch instructions, so administrators should consult PHP’s current guidance.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
