What A 22-Year PHP2Shell Investigation Reveals About AI-Assisted Review

🔍 Read the full analysis: What A 22-Year PHP2Shell Investigation Reveals About AI-Assisted Review on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get hardware and tech essentials delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP shipped fixes on October 21, 2026, for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. Calif and Wiz found related flaws in separate research efforts involving AI tools, while the vulnerabilities’ underlying history reaches back to a 2004 security warning about PHP interruptions during memory-limit handling.

Calif’s account says its researcher, Ryan Austin, found several independent paths to remote code execution on August 1. He reported one issue to PHP on August 11, supplied a working proof of concept on August 14, and received confirmation from PHP the next day. Calif reported a second bug on August 21. The company says its work used generally available models and did not require a special testing harness.

Wiz Research worked separately, according to its disclosure. Wiz says it found its first PHP vulnerability on August 19 using its Wiz Atlas platform alongside Gemini 4 Argon and GPT-5.6 Sol. It reported unauthenticated code execution against Drupal on August 20 and WordPress on August 21, then notified PHP on August 24. PHP’s security team shipped the fixes; the source material identifies both CVE numbers but does not specify the full release or deployment details.

The investigation ties the flaws to unsafe interruption: if PHP stops a request for exceeding its memory limit while an operation is only partly complete, later cleanup may encounter an inconsistent state. That mechanism is not, by itself, a complete explanation of each patched vulnerability. The source describes the 2026 findings as remote code execution flaws and places them in a longer history of memory-exhaustion bugs and incomplete cleanup.

Why Old PHP Bugs Still Matter

PHP remains widely used to run websites and web applications, so remote code execution defects in the runtime can affect software built on top of it. The reported demonstrations against Drupal and WordPress indicate why the discoveries drew attention: a weakness in a shared runtime can have consequences beyond a single application. The source does not quantify affected installations or establish how many systems remain unpatched.

The account also offers a more qualified view of AI-assisted security research than a claim that models independently discover every bug. Calif’s Austin chose a target he knew well and drew on knowledge of the vulnerability’s history. AI tools supported the search, but the direction came from a researcher’s theory about where defects might remain. That distinction matters to security teams deciding how to use these tools: model assistance can accelerate investigation, while expertise still shapes the questions and validates the results.

For PHP operators, the immediate consequence is practical: review the relevant PHP fixes and determine whether affected deployments have applied them. The source points readers to a separate patch-and-restart guide but does not provide versions or a complete remediation matrix in the supplied material. Readers should consult PHP’s official security advisories for release-specific instructions.

From a 2004 Warning to PHP2Shell

In July 2004, security researcher Stefan Esser published an advisory warning that a remote attacker could trigger PHP’s memory-limit termination at a point where interruption was unsafe. The advisory, identified as CAN-2004-0594, described the possibility of using that condition to execute code on remote servers. PHP fixed the specific paths Esser reported, but the broader issue of interruption during an operation remained part of the longer story described by Calif.

A later clue appeared in PHP bug #78876, filed in November 2019. The report said oversized multipart form fields could cause an out-of-memory failure and leave temporary upload files behind. PHP fixed the issue in May 2020, and it received CVE-2019-11048 as a denial-of-service vulnerability because leftover files could consume disk space. Calif’s retelling treats the cleanup failure as a signal to investigate what else might remain after memory exhaustion.

There is a distinction between that account and the available audit record. A 2024 PHP audit by Quarkslab, with OSTIF and the PHP Foundation, published 27 findings and four CVEs, which the source says were resolved. Calif says the auditors rediscovered the out-of-memory issue but did not prove exploitation, so it was not fixed then. OSTIF’s summary, as described in the source, does not mention that issue. The 2026 investigation followed after OpenAI invited Calif to its Patch the Planet initiative.

““possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe””

— Stefan Esser, in his July 2004 security advisory, as quoted in Calif’s account

Open Questions on Exposure and Fixes

The supplied information does not identify which PHP versions are affected, which exact releases contain the fixes, or how many servers may still be vulnerable. It also does not establish whether attackers exploited either flaw in the wild. No evidence of real-world exploitation is provided here, but that absence in the source material is not proof that exploitation did not occur.

Some details about the earlier audit remain contested or incomplete. Calif says the 2024 auditors saw the out-of-memory issue again but could not prove exploitability; the OSTIF summary cited in the source does not include that finding. The material also does not give the full technical breakdown of each 2026 CVE, so the precise relationship between the historical issues and both patched vulnerabilities cannot be independently reconstructed from this account alone.

Patch Status and Further Disclosure

The next practical step for PHP administrators is to check the official PHP security notices for the affected branches and patched release numbers, then apply the appropriate update. Operators should also review whether applications or services expose the relevant PHP request paths. The source says PHP has shipped fixes, but does not specify a deadline or report how quickly hosting providers and application operators are deploying them.

Further technical disclosures from PHP, Calif, and Wiz may clarify the vulnerable code paths, affected versions, and mitigation details. Any assessment of the AI contribution will also depend on those technical accounts: the current reporting describes tools and timelines, while leaving the complete model-assisted workflow and the full comparison between the teams’ findings unclear.

Key Questions

What are the PHP2Shell vulnerabilities?

PHP2Shell is the name used for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. PHP shipped fixes for them on October 21, 2026.

Who found the flaws?

Calif and Wiz Research reported related vulnerabilities through separate investigations. Calif’s account credits researcher Ryan Austin; Wiz says it used its Wiz Atlas platform with Gemini 4 Argon and GPT-5.6 Sol.

Did AI discover the vulnerabilities on its own?

The supplied accounts describe AI-assisted research, not fully autonomous discovery. Calif says Austin selected the target and guided the investigation using prior knowledge of PHP’s vulnerability history. The full division of work between researchers and models is not detailed.

Were the flaws exploited in the wild?

The source material does not say whether either flaw was exploited by attackers. It describes proof-of-concept testing and demonstrations against Drupal and WordPress, but those are not evidence of exploitation in real-world attacks.

What should PHP operators do now?

Check PHP’s official security advisories for the affected versions and patched releases, then update applicable systems. The supplied material does not list version-specific instructions, so administrators should verify the details against PHP’s release guidance.

Source: ThorstenMeyerAI.com