🔍 Read the full analysis: How AI-Assisted Review Helped Bring A 22-Year PHP2Shell Story To A Close on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
PHP released fixes on October 21, 2026, for two critical remote code execution flaws known as PHP2Shell, CVE-2026-109618 and CVE-2026-109619. Calif and Wiz Research independently identified vulnerabilities with AI-assisted review, while earlier reports and audits documented related out-of-memory behavior without establishing the same exploit. The fixes close this disclosure, but the supplied accounts do not establish that every related interruption risk has been eliminated.
PHP released fixes on October 21, 2026, for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. Calif and Wiz Research found vulnerabilities in the widely used runtime through separate investigations that included AI tools, bringing a disclosure story tied to a security warning from 2004 to a patch release.
The research accounts connect the new vulnerabilities to a long-standing concern: a request that runs out of memory may be interrupted while PHP is in the middle of setting up or cleaning up resources. Calif’s account says researcher Ryan Austin found several independent paths to remote code execution on August 1, 2026. Calif reported its first bug to PHP on August 11, sent a working proof of concept on August 14, and says PHP confirmed the issue the following day. It reported a second bug on August 21.
Wiz Research worked separately, according to its disclosure. Wiz says it found its first PHP vulnerability on August 19, confirmed unauthenticated code execution against Drupal and WordPress on August 20 and 21, and reported the issue to PHP on August 24. The supplied accounts identify AI models and research platforms used by both teams, but they do not establish that AI independently discovered the flaws: researchers selected targets, directed investigations and validated results.
The PHP security team released the fixes on October 21. The source material identifies the two CVEs and describes them as critical remote code execution flaws, but does not provide affected-version ranges, patch details or technical steps for checking whether a particular installation is vulnerable. Those specifics should be taken from PHP’s security advisories rather than inferred from the research narratives.
Infographic 01 · Timeline
One class of bug, four chances to catch it.
The flaws fixed on 21 October 2026 continue a line that starts with a 2004 advisory about unsafe interruptions.
- Jul 2004Stefan Esser: memory_limit can stop PHP “where an interruption is unsafe”Advisory 11/2004, CAN-2004-0594. Remote code execution was possible. (e-matters)
- 28 Nov 2019Bug #78876: long upload fields cause out-of-memory, temp files left behindFixed May 2020 as CVE-2019-11048, a denial-of-service issue at the time. (PHP bug tracker)
- 2024Quarkslab audit with OSTIF and the PHP FoundationAccording to Calif, it rediscovered the same OOM issue; exploitation was not proven, so it stayed open. (Calif, OSTIF)
- 30 Jul 2026Calif joins OpenAI’s Patch the Planet and picks PHPStefan Esser brings in the PHP Foundation through Volker Dusch. (Calif)
- 1–21 Aug 2026Calif finds several RCE paths and reports two bugs to PHPFirst report 11 Aug, working proof of concept 14 Aug, confirmed by PHP 15 Aug, second report 21 Aug. (Calif)
- 19–24 Aug 2026Wiz Research finds its first PHP flaw and reports on 24 AugUsing Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol; RCE confirmed on Drupal and WordPress. (Wiz)
- 21 Oct 2026PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 releasedCVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2. Public disclosure the same day. (PHP)
“…possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe.”Stefan Esser, e-matters Advisory 11/2004
Sources: e-matters Advisory 11/2004; PHP bug #78876; OSTIF; Calif: php2shell; Wiz Research (21 Oct 2026); PHP security advisory (21 Oct 2026).
Powered by Thorsten Meyer AI
Why PHP2Shell Matters to Operators
Remote code execution can let an attacker run code on a server, making these vulnerabilities relevant to organizations that host PHP applications and services built on frameworks or content-management systems. The research accounts say Wiz validated unauthenticated code execution against Drupal and WordPress; that describes testing reported by Wiz, not proof that every installation of those products was exposed or compromised.
The longer history matters because it shows how a familiar failure mode can remain security-relevant even after particular bugs are fixed. An out-of-memory termination may leave partially created state or resources that cleanup code handles unsafely. The 2004 warning did not itself prove these 2026 flaws, and the supplied material does not say that every aspect of the old issue remained continuously exploitable. It does show why reviewing old advisories and bug reports can give researchers a useful direction.
The episode also offers a more limited lesson about AI security research than headlines may suggest. Calif’s account emphasizes Austin’s prior knowledge of PHP’s vulnerability history; the tools helped with the search, but the researcher supplied the theory and assessed the findings. For maintainers, that distinction matters: AI-assisted review can support security work, while human investigation, disclosure and patching remain part of the process.
Popular right now
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Twilight Blue
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, Almond Cream
Dyson V8 Cyclone Cordless Vacuum
As an affiliate, we earn on qualifying purchases.
From the 2004 Advisory to PHP2Shell
In July 2004, security researcher Stefan Esser published an advisory warning that an attacker could trigger PHP’s memory-limit termination at a point where interruption was unsafe. The advisory, identified in the source as CAN-2004-0594, described a risk of executing code on remote PHP servers. PHP fixed the specific paths Esser reported, but the broader concern about interruption during unsafe operations remained part of the history recounted by Calif.
A later clue appeared in PHP bug tracker report #78876, filed November 28, 2019. It described very long multipart form fields causing an out-of-memory error and leaving temporary files behind. PHP fixed the issue in May 2020, and it received CVE-2019-11048. At that time, the reported impact was denial of service because accumulated files could fill a disk; the report did not establish remote code execution.
Calif says a 2024 audit rediscovered the out-of-memory issue but did not prove exploitation. The published audit summary cited in the source lists 27 findings and four CVEs, all resolved, and does not mention that issue. The distinction between the audit record and Calif’s account is relevant: a rediscovery without demonstrated exploitability is not the same as a confirmed remote-code-execution vulnerability.
“No model is simply capable of unearthing ‘all bugs.'”
— Ryan Austin, Calif researcher, as quoted in Calif’s account
What the Disclosures Do Not Settle
The supplied material does not identify the affected PHP versions, give the full technical details of either flaw, or explain whether the two CVEs represent distinct exploit paths or related cases within the same vulnerability class. It also does not report how many systems were exposed, whether attackers exploited the flaws before the fixes, or whether any incidents have been confirmed.
There is also a difference between what the source attributes to Calif and what the cited public audit summary records about the 2024 finding. Calif says auditors saw the out-of-memory issue again, while the summary it cites does not mention it. The material does not supply the audit finding itself, so that account cannot be independently reconciled here. Nor does the history prove that all possible unsafe-interruption bugs in PHP are now gone.
Patch Deployment and Further Review
PHP users should consult the project’s security advisories for the affected release branches, patched versions and upgrade instructions, then apply the appropriate fix. Administrators should also check application and hosting dependencies that bundle or manage PHP, and follow their normal process for restarting services and verifying deployed versions. The source material does not state a deadline or provide a list of affected releases, so those details should come from PHP’s official guidance.
The next public milestones are likely to be further technical detail from the researchers and PHP, plus any follow-up reports about patch adoption or exploitation. Until that information is available, the confirmed development is the release of fixes for the two named critical vulnerabilities—not evidence that every installation has been updated or that the wider class of risk has been eliminated.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used in the source material for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, for which PHP released fixes on October 21, 2026.Who found the vulnerabilities?
The supplied accounts credit Calif and Wiz Research with separate investigations. Both teams describe using AI tools as part of their work, alongside researcher-led analysis and validation.Does the 2004 advisory prove PHP was vulnerable for 22 years?
No. The advisory warned about unsafe interruption and PHP fixed the specific paths reported then. Calif connects that history to the later research, but the source does not establish that the 2026 vulnerabilities remained continuously exploitable from 2004 onward.Were PHP2Shell flaws exploited in the wild?
The supplied material does not confirm real-world exploitation or provide incident data. Wiz’s reported tests against Drupal and WordPress are not evidence that attackers exploited public installations.What should PHP administrators do?
Check PHP’s official security advisories for affected versions and upgrade instructions, then apply the relevant fix and verify the deployed version. The source material does not specify the affected release range.Source: ThorstenMeyerAI.com
