🔍 Read the full analysis: AI-Assisted Review Brings New Perspective To The PHP2Shell Story on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
PHP released fixes on October 21, 2026, for two critical remote code execution vulnerabilities known as PHP2Shell. Calif, OpenAI and Wiz used AI-assisted research in separate investigations, while the underlying risk echoed a class of issue described in a 2004 advisory. The precise scope of affected systems and some details of the parallel research remain unclear from the available account.
The two vulnerabilities affect PHP, a programming language used to build and run a large share of websites. Remote code execution can allow an attacker to run code on a vulnerable server, although the source account does not provide a complete account of affected versions, configurations or exploitation in the wild. PHP’s security team issued fixes for both flaws on October 21.
According to Calif’s published timeline, its researcher Ryan Austin found several potential paths to remote code execution on August 1, 2026. Calif says it reported one issue to PHP on August 11, supplied a proof of concept on August 14 and received confirmation the following day. It reported a second issue on August 21. Wiz Research was investigating separately: its post says it found a PHP vulnerability on August 19 and reported it to PHP on August 24.
The research accounts describe AI as an aid, not an independent substitute for security researchers. Calif says Austin used generally available models and no special testing harness. OpenAI said Calif used GPT-5.6 Sol through its Patch the Planet program. Wiz says it used its Wiz Atlas platform alongside Gemini 4 Argon and GPT-5.6 Sol. The PHP security team is credited with preparing the patches.
Infographic 01 · Timeline
One class of bug, four chances to catch it.
The flaws fixed on 21 October 2026 continue a line that starts with a 2004 advisory about unsafe interruptions.
- Jul 2004Stefan Esser: memory_limit can stop PHP “where an interruption is unsafe”Advisory 11/2004, CAN-2004-0594. Remote code execution was possible. (e-matters)
- 28 Nov 2019Bug #78876: long upload fields cause out-of-memory, temp files left behindFixed May 2020 as CVE-2019-11048, a denial-of-service issue at the time. (PHP bug tracker)
- 2024Quarkslab audit with OSTIF and the PHP FoundationAccording to Calif, it rediscovered the same OOM issue; exploitation was not proven, so it stayed open. (Calif, OSTIF)
- 30 Jul 2026Calif joins OpenAI’s Patch the Planet and picks PHPStefan Esser brings in the PHP Foundation through Volker Dusch. (Calif)
- 1–21 Aug 2026Calif finds several RCE paths and reports two bugs to PHPFirst report 11 Aug, working proof of concept 14 Aug, confirmed by PHP 15 Aug, second report 21 Aug. (Calif)
- 19–24 Aug 2026Wiz Research finds its first PHP flaw and reports on 24 AugUsing Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol; RCE confirmed on Drupal and WordPress. (Wiz)
- 21 Oct 2026PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 releasedCVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2. Public disclosure the same day. (PHP)
“…possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe.”Stefan Esser, e-matters Advisory 11/2004
Sources: e-matters Advisory 11/2004; PHP bug #78876; OSTIF; Calif: php2shell; Wiz Research (21 Oct 2026); PHP security advisory (21 Oct 2026).
Powered by Thorsten Meyer AI
Why PHP2Shell Reaches Beyond One Patch
PHP underpins a large number of websites and web applications, so vulnerabilities that permit remote code execution can carry consequences beyond an individual installation. A successful attack may give an intruder a path to run commands on a server. The available source does not establish that the flaws have been exploited publicly, and risk depends on affected software and deployment details that are not specified here.
The episode also offers a grounded example of AI-assisted security work. The researchers’ accounts describe models helping with vulnerability discovery, exploit development, attack detection or patch validation. But the older history suggests that recognizing a useful line of inquiry still depends on human judgment and knowledge of prior bugs. The work does not show that AI tools can find every flaw or that automated review alone can establish a system is safe.
For maintainers and operators, the immediate practical issue is the release of fixes: they need to identify whether their PHP environments are affected and apply the relevant patched versions. The source article points readers to a separate patch and restart guide, but does not list the version numbers in the material provided here.
As an affiliate, we earn on qualifying purchases.
From a 2004 Warning to 2026
The history described in Calif’s account starts with a July 2004 advisory by Stefan Esser of e-matters. It warned that an attacker might trigger PHP’s memory-limit termination at a point where interrupting execution was unsafe, potentially allowing code execution. PHP fixed the specific paths then reported, but the account says the wider challenge of interruptions occurring at unsafe moments remained difficult.
A later clue appeared in PHP bug tracker report #78876, filed in November 2019. It described large multipart form fields causing an out-of-memory condition and leaving temporary files behind. PHP fixed the issue in May 2020, and it received CVE-2019-11048 as a denial-of-service vulnerability because leftover files could consume disk space. Calif’s account interprets the residue as a signal to ask what else an out-of-memory failure might leave in an unsafe state.
Calif says a 2024 PHP audit rediscovered the out-of-memory issue but did not prove exploitation. The audit’s published summary, according to the source material, lists 27 findings and four CVEs but does not mention that issue. The distinction between a reported condition and a demonstrated exploit is relevant: the source does not present the 2024 finding as a confirmed route to remote code execution.
“Possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe.”
— Stefan Esser, in the 2004 advisory as quoted by Calif
remote code execution vulnerability tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Affected Builds and Exploitation Status
The supplied material does not specify which PHP versions or configurations are vulnerable, list the fixed version numbers, or explain whether both CVEs affect the same set of deployments. Those details are needed to determine exposure and should be checked against PHP’s advisories and the relevant release notes.
It is also unclear from this account whether either flaw has been exploited outside controlled research. Calif and Wiz describe testing and disclosure, but the source provides no confirmed evidence of attacks in the wild. The exact technical relationship between the two CVEs, the complete disclosure coordination timeline and the role of each AI model in each finding are not fully detailed here.
Claims about the 2024 audit should also remain attributed. Calif says auditors encountered the same out-of-memory issue but did not prove exploitation; the audit summary cited in the account does not mention it. The available sources therefore do not establish that the audit formally recorded the issue in the published findings.
As an affiliate, we earn on qualifying purchases.
Patch Rollout and Disclosure Details
PHP maintainers and operators will need to consult the project’s security advisories for affected branches and patched release numbers, then update systems where applicable. The source material confirms that fixes shipped October 21, but does not provide the release matrix or instructions needed to verify a particular installation.
Further details may come from PHP’s advisories and the researchers’ technical disclosures, including fuller explanations of the vulnerabilities, affected configurations and defensive checks. Organizations should distinguish confirmed patch guidance from assumptions based on the PHP2Shell label; the available account does not establish the exposure of any specific website or service.
The public record may also clarify how the separate Calif and Wiz investigations intersected and what tasks AI systems performed. For now, the confirmed development is that PHP released fixes for two critical remote code execution flaws after coordinated research. The extent of real-world exposure and exploitation remains unconfirmed in the material available.
PHP vulnerability detection software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is PHP2Shell?
PHP2Shell is the name being used for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, for which PHP released fixes on October 21, 2026.
Who found the vulnerabilities?
The source describes work by Calif and Wiz Research in separate investigations, with AI tools involved. OpenAI’s Patch the Planet initiative supported Calif’s work; Wiz says it used its platform and models from Google and OpenAI.
Were the flaws exploited in real-world attacks?
The available source does not confirm exploitation in the wild. It describes research testing and disclosure, but provides no evidence of attacks against public-facing systems.
What should PHP operators do?
Check the official PHP security advisories for affected versions and patched releases, then update any affected installation. The source material confirms patches shipped but does not include version-specific instructions.
Does this show AI can find all software bugs?
No. Calif researcher Ryan Austin said, “No model is simply capable of unearthing ‘all bugs.’” The accounts describe AI-assisted research guided by human investigators, not a guarantee that automated tools can find every vulnerability.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
