The 22-Year Road To PHP2Shell: How AI-Assisted Review Finished An Old Story

🔍 Read the full analysis: The 22-Year Road To PHP2Shell: How AI-Assisted Review Finished An Old Story on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP shipped fixes on October 21, 2026, for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. Research by Calif and Wiz, with AI tools assisting their reviews, brought attention to vulnerabilities in a widely used web runtime and to a related security problem first described in 2004.

The development links current security research to an older vulnerability pattern: a request can run out of memory at a moment when PHP is in the middle of setting up internal structures. If termination occurs at an unsafe point, cleanup may encounter partially constructed state. The source account describes the PHP2Shell flaws as critical remote code execution vulnerabilities, but does not provide the full technical details of how each flaw works.

Calif’s timeline says its researchers found several independent paths to remote code execution on August 1, 2026. It says one finding was time-stamped with a published hash on August 5, reported to PHP on August 11, and accompanied by a working proof of concept on August 14. PHP confirmed the first report on August 15; Calif reported a second flaw on August 21.

Wiz Research worked separately, according to the account. Wiz says it found its first PHP vulnerability on August 19, confirmed unauthenticated code execution against Drupal on August 20 and WordPress on August 21, then reported the issue to PHP on August 24. Those product tests are claims made in the researchers’ disclosure materials; the source provided here does not include independent technical validation. PHP’s fixes are the confirmed outcome.

How AI Assisted the PHP Review

The findings matter because remote code execution can allow an attacker to run code on an affected server, creating serious risk for services that rely on vulnerable PHP deployments. The source describes PHP as powering a large share of the web, but supplies no figure or measurement for that claim. The exact exposure depends on the affected versions, configurations and deployed applications, details that are not included in the material.

The research also offers a more specific account of AI’s role than the claim that a model discovered the flaws by itself. Calif researcher Ryan Austin chose a target he knew, drew on the history of PHP vulnerabilities and pursued a theory about where weaknesses might remain. Calif says its work used generally available models without a special harness. The source attributes use of GPT-5.6 Sol to Calif’s work and says Wiz used its Wiz Atlas platform with Gemini 4 Argon and GPT-5.6 Sol.

That distinction is relevant to security teams evaluating AI-assisted review. The source’s account suggests that researcher judgment directed the search, while models helped with parts of the review. It does not establish that AI tools alone would have found the flaws, or that the same approach will work on other software.

From a 2004 Warning to PHP2Shell

The earlier history begins with a July 2004 advisory by Stefan Esser of e-matters, published on the Bugtraq mailing list as Advisory 11/2004, “PHP memory_limit remote vulnerability” (CAN-2004-0594). Esser warned that an attacker could trigger PHP’s memory-limit termination where interruption was unsafe, and said the problem could be abused to run code remotely. PHP fixed the specific paths he reported, according to the source, while the broader class of unsafe interruptions remained difficult to eliminate.

A later clue appeared in PHP bug report #78876, filed on November 28, 2019. The report said very large multipart form fields could cause an out-of-memory condition and leave temporary upload files behind. PHP fixed the issue in May 2020; it received CVE-2019-11048 and was treated as a denial-of-service problem because leftover files could fill a disk.

The source also points to a 2024 PHP audit by Quarkslab with OSTIF and the PHP Foundation. Its published results listed 27 findings and four CVEs, all resolved. Calif says the auditors rediscovered the out-of-memory issue but did not prove exploitation. OSTIF’s summary, as described in the source, does not mention that issue, so the characterization of the audit finding rests on Calif’s account.

““possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe””

— Stefan Esser, in his July 2004 security advisory

Exposure and Technical Details Still Pending

The source material does not specify which PHP versions are affected, the patched release numbers, or whether particular configurations are more exposed. It also does not include PHP’s advisory text, the complete vulnerability descriptions or a full account of the fixes. Readers should consult PHP’s official security notices for release-specific guidance rather than infer exposure from the historical narrative.

Some parts of the timeline are attributed accounts rather than independently corroborated findings. Calif’s description of the 2024 audit issue is not reflected in the OSTIF summary cited by the source, and the claims about successful testing against Drupal and WordPress come from Wiz’s disclosure. The source says both teams found related flaws, but does not lay out enough technical detail to determine how the two CVEs relate to each other or to earlier reports.

It is also unclear from the supplied material how many systems remain unpatched, whether the flaws have been exploited in the wild, or whether additional vulnerabilities were found during the review. No exploitation in real-world attacks is reported here; that is not confirmation that none occurred.

Check PHP Advisories and Patch Status

PHP maintainers have shipped fixes, so administrators should identify their deployed PHP versions and check the official PHP security releases for applicable patched versions and upgrade instructions. Application owners should also review the security notices for software built on PHP, including any relevant guidance from their hosting provider or distribution maintainer.

The supplied account does not name the patched release numbers or set out a schedule for further disclosures. The next useful milestones are the publication of PHP’s technical advisories, any expanded write-ups from Calif and Wiz, and confirmation of which versions and configurations are affected. Until those details are available, the number of exposed deployments and any real-world exploitation remain unknown.

Key Questions

What are PHP2Shell?

PHP2Shell is the name used in the source material for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP shipped fixes on October 21, 2026; the supplied account does not list affected or patched version numbers.

Who found the vulnerabilities?

The source credits research by Calif and Wiz. The teams say they worked separately and reported findings to PHP in August 2026. PHP’s security team shipped the fixes.

What role did AI play?

According to the researchers’ accounts, AI tools assisted security review and related testing. Calif says researcher Ryan Austin selected the target and guided the search using knowledge of PHP’s vulnerability history. The material does not show that a model found the flaws independently.

Does the 2004 advisory describe the same bugs?

The source connects the new findings to a broader class of risk involving memory-limit termination at unsafe moments. It does not establish that the 2004 advisory and the 2026 CVEs are the same vulnerabilities; PHP fixed the specific paths reported in 2004.

How can PHP operators check whether they need to act?

Check PHP’s official security notices for the affected releases and upgrade guidance, then compare that information with the version in use. The supplied source does not identify patched version numbers, so it cannot establish an operator’s exposure on its own.

Source: ThorstenMeyerAI.com