🔍 Read the full analysis: Reopening The PHP2Shell Story With AI-Assisted Code Review on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
PHP shipped fixes on October 21, 2026, for two critical remote code execution vulnerabilities known as PHP2Shell, CVE-2026-109618 and CVE-2026-109619. Calif, OpenAI and Wiz are credited with research involving AI-assisted code review; the account traces the underlying bug class to a 2004 warning and later PHP bug reports.
PHP shipped fixes on October 21, 2026, for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, now called PHP2Shell. Research credit goes to Calif, OpenAI and Wiz, whose work included AI-assisted code review; the flaws matter because PHP runs a substantial share of websites and the vulnerabilities could allow remote code execution.
The published account describes the vulnerabilities as part of a longer-running class of bugs: an interruption such as a memory-limit failure can occur while PHP is setting up data structures, leaving incomplete state for cleanup code to handle. The historical warning was not itself proof of these 2026 vulnerabilities. It provides context for why researchers revisited how PHP behaves when a request runs out of memory.
Calif’s timeline says it found several possible paths to remote code execution on August 1, reported a first bug to PHP on August 11, supplied a working proof of concept on August 14, and received confirmation the following day. It reported a second bug on August 21. Calif researcher Ryan Austin’s account says his approach combined knowledge of PHP’s vulnerability history with AI assistance, and did not rely on a special test harness.
Wiz Research says it worked independently. Its disclosure says the team found its first PHP vulnerability on August 19, validated unauthenticated code execution against Drupal and WordPress on August 20 and 21, and reported the issue to PHP on August 24. The account credits Calif, OpenAI and Wiz with research and the PHP security team with the fixes. The supplied material does not give the affected PHP versions or detailed patch instructions.
Infographic 01 · Timeline
One class of bug, four chances to catch it.
The flaws fixed on 21 October 2026 continue a line that starts with a 2004 advisory about unsafe interruptions.
- Jul 2004Stefan Esser: memory_limit can stop PHP “where an interruption is unsafe”Advisory 11/2004, CAN-2004-0594. Remote code execution was possible. (e-matters)
- 28 Nov 2019Bug #78876: long upload fields cause out-of-memory, temp files left behindFixed May 2020 as CVE-2019-11048, a denial-of-service issue at the time. (PHP bug tracker)
- 2024Quarkslab audit with OSTIF and the PHP FoundationAccording to Calif, it rediscovered the same OOM issue; exploitation was not proven, so it stayed open. (Calif, OSTIF)
- 30 Jul 2026Calif joins OpenAI’s Patch the Planet and picks PHPStefan Esser brings in the PHP Foundation through Volker Dusch. (Calif)
- 1–21 Aug 2026Calif finds several RCE paths and reports two bugs to PHPFirst report 11 Aug, working proof of concept 14 Aug, confirmed by PHP 15 Aug, second report 21 Aug. (Calif)
- 19–24 Aug 2026Wiz Research finds its first PHP flaw and reports on 24 AugUsing Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol; RCE confirmed on Drupal and WordPress. (Wiz)
- 21 Oct 2026PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 releasedCVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2. Public disclosure the same day. (PHP)
“…possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe.”Stefan Esser, e-matters Advisory 11/2004
Sources: e-matters Advisory 11/2004; PHP bug #78876; OSTIF; Calif: php2shell; Wiz Research (21 Oct 2026); PHP security advisory (21 Oct 2026).
Powered by Thorsten Meyer AI
Why PHP2Shell Affects Website Operators
Remote code execution flaws can let an attacker run code on a vulnerable server, making the PHP fixes relevant to website owners and software teams using PHP-based applications. Wiz’s reported tests against Drupal and WordPress illustrate the potential reach across common platforms, but do not establish that every installation of those products was vulnerable or exposed.
The research also shows how AI tools can contribute to security work without replacing human judgment. Austin says the researcher chose the target and directed the inquiry using knowledge of older vulnerabilities. His conclusion, as quoted in the source account, cautions against treating models as able to find every flaw. For maintainers, the practical lesson is to apply the PHP security updates and check official guidance for the versions they run.
As an affiliate, we earn on qualifying purchases.
From a 2004 Warning to PHP2Shell
In July 2004, security researcher Stefan Esser published an advisory warning that PHP’s memory-limit mechanism could terminate a request at an unsafe point. The advisory described possible remote code execution. PHP fixed the specific paths Esser reported, while the broader issue of interruption during incomplete operations remained a subject for later investigation.
A PHP bug report filed in November 2019 described large multipart form fields causing an out-of-memory condition and leaving temporary files behind. PHP fixed that issue in May 2020; it was assigned CVE-2019-11048 and treated as a denial-of-service problem. Calif later interpreted it as a clue about what else might remain after an out-of-memory failure.
Calif also says a 2024 audit encountered the issue again but did not prove exploitability. The published audit summary cited in the source lists 27 findings and four CVEs, all resolved, and does not mention an out-of-memory issue. The discrepancy between that summary and Calif’s description cannot be resolved from the available material.
“rediscovered the same OOM issue”
— Calif, describing the 2024 audit
PHP security vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Affected PHP Versions Still Unspecified
The source material does not identify which PHP versions are affected, list the patched release numbers, or provide complete mitigation instructions. It also does not establish how many servers were vulnerable, whether the flaws were exploited in real-world attacks, or whether any applications beyond the reported Drupal and WordPress tests were validated.
Some details are accounts by the research teams rather than independently established findings in the material. In particular, Calif’s description of the 2024 audit’s out-of-memory finding is not reflected in the cited audit summary. The precise technical relationship between the historical bug reports and the two 2026 vulnerabilities is not fully documented here.
remote code execution vulnerability patch
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Operators Should Check PHP Advisories
Website operators and hosting providers should consult PHP’s official security advisories and release notes to identify affected versions and install the applicable fixes. They should also check their application and hosting configurations rather than assume that testing against Drupal or WordPress applies to every deployment. The supplied account says the fixes shipped October 21 but does not state a later release schedule or describe any follow-up investigation.
Further reporting would need the affected-version list, technical advisory details and evidence about exploitation in the wild. Until those details are available, the confirmed development is the release of fixes for two critical vulnerabilities, not a verified account of widespread attacks.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used for two critical PHP remote code execution flaws: CVE-2026-109618 and CVE-2026-109619. PHP shipped fixes on October 21, 2026.
Who found the vulnerabilities?
The source account credits Calif, OpenAI and Wiz with research. Calif and Wiz describe separate research efforts, with AI tools used as part of their work.
Were AI models solely responsible for finding the flaws?
No. Calif researcher Ryan Austin described choosing the target and directing the investigation based on knowledge of PHP’s history. The account presents AI as an aid to researchers, not as an independent replacement for them.
Which PHP versions need updating?
The supplied source does not list affected versions or patched release numbers. PHP users should check the official PHP security advisories and release notes for the applicable update information.
Is there evidence the flaws were exploited in attacks?
The source material does not establish that PHP2Shell was exploited in real-world attacks. It describes research and validation, including tests against Drupal and WordPress, but provides no confirmed incident reports.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
