PHP2Shell Explained: Revisiting An Old Story With AI-Assisted Review

🔍 Read the full analysis: PHP2Shell Explained: Revisiting An Old Story With AI-Assisted Review on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on monitors, keyboards and dev gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

PHP shipped fixes on October 21, 2026, for two critical remote code execution flaws known as PHP2Shell, following separate research efforts by Calif and Wiz Research in which AI tools assisted the work. The vulnerabilities, listed as CVE-2026-109618 and CVE-2026-109619, matter because PHP runs a large share of the web; the available account does not specify affected releases or provide the patch instructions needed for administrators to assess exposure.

According to Calif’s account, its researcher Ryan Austin found several independent paths to remote code execution on August 1, 2026. Calif reported its first flaw to PHP on August 11, shared a proof of concept on August 14, and says PHP confirmed the issue the following day. The group reported a second flaw on August 21. The account says Austin had published a hash of one finding on August 5, creating a way to establish later that he possessed it without disclosing the vulnerability itself.

Wiz Research worked separately, according to its disclosure post. Wiz says it found its first PHP vulnerability on August 19, validated unauthenticated code execution against Drupal on August 20 and WordPress on August 21, and reported the issue to PHP on August 24. The source identifies AI tools used in the effort, including Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. It does not detail how the two teams’ findings map to each CVE or whether their reported paths overlap.

The PHP security team made the fixes available on October 21, the source says. Calif, OpenAI and Wiz receive research credit in the supplied account, while the fixes are credited to PHP’s security team. The source material does not include PHP’s advisory text, a version-by-version patch list, or confirmation of exploitation in real-world attacks.

Why PHP Runtime Fixes Matter

Remote code execution flaws can allow an attacker to run code on a vulnerable server, so fixes in a widely used runtime can affect many kinds of sites and applications. The source names Drupal and WordPress as systems against which Wiz validated code execution, but it does not say that either project itself contains the underlying PHP flaw. Operators need the PHP advisory and release details to determine whether their deployments are affected and which update to apply.

The story also offers a more specific account of AI’s role than the claim that a model independently discovered a vulnerability. Calif’s description presents a researcher who chose a target, drew on knowledge of PHP’s past bug reports, and directed the search. AI tools aided the investigation, but the source does not establish that they acted without researcher guidance or that they can find vulnerabilities broadly on their own.

From Memory Limits to PHP2Shell

The account traces the vulnerability class to a July 2004 advisory by Stefan Esser, then of e-matters. His Bugtraq post, Advisory 11/2004, warned that a remote attacker could trigger PHP’s memory-limit termination at a point where interruption was unsafe. The risk, as described in the source, is that PHP may stop while constructing or managing an internal structure, leaving cleanup code to handle a partially completed state. PHP fixed the specific paths Esser reported, but the wider concern about interruptions at unsafe moments persisted.

A later clue appeared in PHP tracker bug #78876, reported on November 28, 2019. The report said very large multipart form fields could cause an out-of-memory condition and leave temporary upload files behind. PHP fixed that issue in May 2020; it received CVE-2019-11048 and was treated as a denial-of-service problem because leftover files could fill a disk. Calif’s retelling says the behavior prompted a broader question about what else might be left behind when a request runs out of memory.

The source also refers to a 2024 PHP audit by Quarkslab with OSTIF and the PHP Foundation. OSTIF’s published summary listed 27 findings and four CVEs, all resolved, but did not mention an out-of-memory issue. Calif says auditors rediscovered the issue, while acknowledging that exploitation was not proven. That account is distinct from the published summary and should not be treated as confirmation that the audit established an exploitable vulnerability.

Affected Versions and Exploitation Status

The supplied material does not identify the PHP versions affected or fixed, provide links to official PHP security advisories, or say whether all supported branches received patches. It also does not state whether the flaws have been exploited outside controlled testing. Wiz says it validated unauthenticated code execution against Drupal and WordPress, but the exact test conditions and affected deployment configurations are not included.

There are also limits to what can be established about the historical trail. Calif attributes a rediscovered out-of-memory issue to the 2024 audit, but OSTIF’s public summary does not mention it, and the source says exploitation was unproven. The material does not provide the technical details needed to determine precisely how the 2004 warning, the 2019 temporary-file issue and the 2026 CVEs relate to one another.

Patch Guidance and Disclosure Details

PHP administrators should consult the official PHP security advisories for CVE-2026-109618 and CVE-2026-109619, confirm which releases are affected, and apply the listed fixes. The source reports that PHP shipped patches on October 21, but it does not include a release matrix or operational instructions; readers should not infer those details from the research timeline alone.

Further disclosures from PHP, Calif and Wiz could clarify affected versions, technical differences between the two flaws, and whether any exploitation has been observed. The research accounts may also provide more detail on how human expertise and AI-assisted review contributed to the findings. Until those details are available, the confirmed development is the release of fixes and the researchers’ reported discovery timelines.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used in the supplied account for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, for which PHP shipped fixes on October 21, 2026.

Who found the PHP2Shell flaws?

The source credits Calif and Wiz Research with separate research efforts. It says AI tools assisted both teams, but does not provide a complete mapping of each researcher’s findings to the two CVE identifiers.

Does the report confirm attacks in the wild?

No. The supplied material describes research and validation, including Wiz’s testing against Drupal and WordPress, but does not confirm real-world exploitation.

Which PHP versions should be updated?

The source does not list affected or fixed PHP versions. Administrators should check the official PHP advisories for both CVEs before deciding which release to install.

Did AI discover the flaws on its own?

The account describes AI-assisted research guided by people. Calif’s Ryan Austin said the researcher’s knowledge of PHP’s history helped direct the work, and cautioned that no model can find all bugs.

Source: ThorstenMeyerAI.com