A New Chapter For PHP2Shell: AI-Assisted Review Of An Old Story

🔍 Read the full analysis: A New Chapter For PHP2Shell: AI-Assisted Review Of An Old Story on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP released fixes on October 21, 2026, for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. The flaws were found through research by Calif and Wiz Research, both of which reported using AI tools in their work; the episode also revisits a risk involving PHP’s memory-limit handling that was described in a 2004 security advisory.

According to Calif’s account, researcher Ryan Austin found several independent paths to remote code execution on August 1. Calif reported its first bug to PHP on August 11, supplied a proof of concept on August 14, and says PHP confirmed the issue the following day. It reported a second bug on August 21. The supplied account identifies the researchers and the PHP security team as responsible for the findings and fixes, but does not provide technical details of the patches.

Wiz Research worked in parallel. Its disclosure post says it found its first PHP vulnerability on August 19 using the Wiz Atlas platform alongside Gemini 4 Argon and GPT-5.6 Sol. Wiz said it confirmed unauthenticated code execution against Drupal on August 20 and WordPress on August 21, then reported the issue to PHP on August 24. Those are claims in Wiz’s account; the source material does not give further details about the affected configurations or the relationship between the teams’ findings.

The research was linked to Patch the Planet, an OpenAI initiative intended to help maintainers secure open-source software. Calif says it used generally available models and no special testing harness. OpenAI’s announcement attributes a critical finding to Calif using GPT-5.6 Sol. The source material says Wiz and Google’s security blog credited Gemini 4 Argon with contributions to finding the vulnerability, exploit development, attack detection and patch validation.

Why the Old PHP Warning Matters

The case shows how a longstanding software weakness can remain relevant even after specific vulnerable paths are fixed. In 2004, security researcher Stefan Esser warned that PHP’s memory limit could terminate a request at a point where interruption was unsafe. The concern is that a process stopped while setting up internal structures may leave incomplete state for cleanup code, creating behavior beyond an ordinary crash.

For PHP users, the immediate significance is practical: the project has issued fixes for vulnerabilities classified in the source as critical remote code execution flaws. For security teams, the timeline also highlights why old bug reports and audit findings merit attention. AI tools may help examine large codebases, but the account describes researchers bringing historical knowledge and a theory about where to look. It does not establish that AI alone found the bugs or that the same approach will produce similar results elsewhere.

From a 2004 Advisory to PHP2Shell

Esser’s July 2004 Bugtraq advisory, titled “PHP memory_limit remote vulnerability,” described the risk of a remote attacker triggering memory-limit termination at an unsafe point. PHP fixed the specific paths he reported, according to the supplied account, but the broader challenge of interruption during sensitive operations remained a concern.

A later clue appeared in PHP bug #78876, reported in November 2019. It described large multipart form fields causing an out-of-memory condition and leaving temporary upload files behind. PHP fixed the issue in May 2020, and it received CVE-2019-11048. At the time, the reported impact was denial of service through disk exhaustion; Calif’s retelling presents the leftover files as a prompt to ask what other state an out-of-memory interruption could leave behind.

A 2024 PHP audit by Quarkslab, conducted with OSTIF and the PHP Foundation, listed 27 findings and four CVEs, according to the source. Calif says auditors rediscovered the out-of-memory issue but did not prove exploitation. OSTIF’s published summary, as described in the source, does not mention that issue. The accounts therefore differ in what they document, and the source does not establish that the 2024 finding was the same as either 2026 vulnerability.

What the Disclosures Do Not Settle

The supplied material does not explain the technical differences between CVE-2026-109618 and CVE-2026-109619, identify affected PHP versions, or detail the exact changes in the October 21 fixes. It also does not say how widely the vulnerabilities were exploited, whether any attacks were observed, or how many installations remain unpatched.

The relationship between Calif’s and Wiz’s findings is not fully described. The account says both teams reached the same class of flaw independently, but it does not establish whether their reports concern the same code paths or how the findings map to the two CVE identifiers. The 2024 audit account is also disputed in the available material: Calif says the issue was rediscovered, while OSTIF’s summary does not mention it, and exploitation was reportedly not proven at that time.

Claims about the contribution of AI tools come from the research teams and the companies associated with those tools. The source provides no independent comparison of model performance, and it does not establish that AI was necessary to find either flaw.

Patch Deployment and Disclosure Details

The immediate next step for organizations running PHP is to identify whether their versions are affected and apply the project’s fixes. The source confirms that PHP shipped fixes on October 21, 2026, but does not list fixed version numbers or provide upgrade instructions. Administrators should consult PHP’s official security advisories and release notes for version-specific guidance, then verify that deployed services are running the patched releases.

Further clarity depends on fuller technical disclosures from PHP and the research teams. Those could establish the affected code paths, the scope of each CVE, and how the separate reports relate. The material provided does not give a timetable for additional publications or say whether PHP plans further changes.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, for which PHP shipped fixes on October 21, 2026.

Who reported the vulnerabilities?

The source credits Calif and Wiz Research with related findings. Calif says it reported bugs to PHP beginning August 11; Wiz says it reported its finding on August 24. The source does not fully explain how the reports map to the two CVEs.

What role did AI play in the research?

Calif says it used GPT-5.6 Sol as part of its research, while Wiz says it used Wiz Atlas with Gemini 4 Argon and GPT-5.6 Sol. These descriptions come from the organizations involved; the source provides no independent assessment of the models’ contribution.

What should PHP administrators do?

Administrators should check PHP’s official advisories and release notes for affected and fixed versions, then apply the relevant update. The supplied account confirms that fixes shipped but does not specify version numbers.

Source: ThorstenMeyerAI.com