Tracing PHP2Shell: A 22-Year Journey With AI-Assisted Review

🔍 Read the full analysis: Tracing PHP2Shell: A 22-Year Journey With AI-Assisted Review on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get smart everyday buys delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP released fixes on Oct. 21, 2026, for two critical remote code execution vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Researchers at Calif and Wiz reported related flaws through separate investigations that used AI tools alongside human-led security review, raising the stakes for organizations running PHP-based services.

The research accounts describe a vulnerability class tied to out-of-memory interruptions: when PHP terminates a request at an unsafe point, partially prepared state may remain for cleanup code to handle. The original report of this broader concern dates to 2004. PHP fixed the specific paths identified then, but the underlying question of what an interrupted request leaves behind resurfaced in later work.

Calif’s timeline says it found several independent paths to remote code execution on Aug. 1, 2026. It reported one flaw to PHP on Aug. 11, supplied a proof of concept on Aug. 14, and says PHP confirmed the issue the next day. Calif reported a second bug on Aug. 21. The account says researcher Ryan Austin had published a hash of one finding on Aug. 5, a way to establish later that he possessed it without disclosing the vulnerability details at the time.

Wiz Research worked separately, according to its disclosure. It says it found its first PHP vulnerability on Aug. 19, validated unauthenticated code execution against Drupal and WordPress on Aug. 20 and 21, and reported the issue to PHP on Aug. 24. The supplied material says PHP shipped fixes on Oct. 21, but does not give patch-version numbers or a complete list of affected configurations. The findings and fixes are attributed to Calif, OpenAI, Wiz and the PHP security team; the exact division of work across each flaw is not fully set out in the material.

Why PHP’s Runtime Security Matters

PHP underpins a large share of websites and web applications, so remote code execution flaws in its runtime can put services at risk if they are exposed and left unpatched. Remote code execution can allow an attacker to run code on a vulnerable server; the researchers’ reported tests against Drupal and WordPress show how PHP weaknesses can affect applications built on top of the language. The source material does not quantify real-world exploitation or confirmed victim numbers.

The development also offers a more specific lesson about AI-assisted security research than a claim that models independently find every flaw. Calif’s account describes a researcher selecting a target and drawing on knowledge of its history to guide the search. AI tools helped with the investigation, but human direction and technical context remained part of the process. For defenders, the immediate practical issue is to review PHP deployments and apply the relevant fixes, rather than infer exposure or safety from the research headlines alone.

From a 2004 Warning to PHP2Shell

In July 2004, security researcher Stefan Esser published an advisory on PHP’s memory limit and warned that remote request termination could occur at a point where interruption was unsafe. His advisory said the behavior could potentially be abused to execute code on remote PHP servers. PHP fixed the specific paths he reported; the 2026 research is presented as a later investigation of the broader class of risk, not as proof that the 2004 vulnerability remained unfixed.

A related clue appeared in PHP bug #78876, filed in November 2019. It reported that oversized multipart form fields could cause an out-of-memory condition and leave temporary upload files on disk. PHP fixed the issue in May 2020, and it received CVE-2019-11048. The issue was treated as denial of service because leftover files could consume disk space. Calif’s account says the behavior prompted a further question: whether an out-of-memory termination could leave behind other exploitable state.

Calif also says a 2024 audit rediscovered the out-of-memory issue, but that exploitation was not demonstrated then. The audit’s published summary, as described in the source material, lists 27 findings and four CVEs but does not mention this issue. This difference between the audit summary and Calif’s account means the precise record of the earlier finding should be read with attribution.

““possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe””

— Stefan Esser, in his July 2004 security advisory

Open Questions on Exposure and Impact

The available account does not identify which PHP releases and configurations are affected, provide the fixed version numbers, or give deployment guidance specific to each supported branch. It also does not report confirmed exploitation in the wild, known victims, or the number of servers exposed. Those details should not be inferred from the existence of proof-of-concept testing against Drupal and WordPress.

The two CVE identifiers are associated with PHP2Shell, but the supplied material does not map each identifier to a distinct flaw or explain whether both vulnerabilities share the same affected code paths. Calif’s description of the 2024 audit finding is also not reflected in the audit summary cited in the account, leaving the exact earlier finding and its handling unclear.

Patch Status and Disclosure Details

PHP operators should consult the PHP security team’s official advisories for the affected versions and apply the relevant fixes. The source material confirms that fixes shipped on Oct. 21, 2026, but does not name the release branches or versions, so administrators should verify those details against PHP’s published notices rather than assume a particular installation is covered.

Further reporting from PHP, Calif and Wiz may clarify the vulnerability-to-CVE mapping, affected releases, technical patch details and whether any exploitation has been observed. Until those points are documented, the confirmed picture is limited to two critical remote code execution flaws, independent research disclosures, and PHP fixes that have been released.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used for two critical remote code execution vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619. The supplied account does not explain how the two identifiers map to separate technical flaws.

When did PHP release the fixes?

The source says PHP shipped fixes on Oct. 21, 2026. It does not provide the fixed version numbers or list the affected release branches.

Did AI discover the vulnerabilities on its own?

No such conclusion is established by the source. Calif describes researcher Ryan Austin directing the investigation with knowledge of PHP’s vulnerability history, while AI tools assisted the review. Wiz also credited AI tools as part of its separate research and validation work.

Is there evidence the flaws were exploited in real attacks?

The supplied material does not report confirmed exploitation in the wild or identify victims. It describes researchers validating code execution in tests involving Drupal and WordPress, which is not the same as evidence of real-world attacks.

What should PHP administrators do?

Administrators should check PHP’s official security advisories for affected versions and apply the corresponding fixes. The source does not include enough version information to determine from this article alone whether a particular installation is vulnerable or patched.

Source: ThorstenMeyerAI.com