Revisiting PHP2Shell: The 22-Year Story Behind An AI-Assisted Review

🔍 Read the full analysis: Revisiting PHP2Shell: The 22-Year Story Behind An AI-Assisted Review on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on monitors, keyboards and dev gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

PHP shipped fixes on October 21, 2026, for two critical remote code execution vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. Separate investigations by Calif and Wiz helped uncover the flaws, with researchers using AI tools as part of their reviews; the episode also renews attention to a class of PHP memory-limit problems that researchers had examined as far back as 2004.

The research account by Thorsten Meyer, published October 22, describes Calif and Wiz as working independently and finding the same broad class of vulnerability within weeks. Calif’s timeline says it found several possible paths to remote code execution on August 1, reported its first bug to PHP on August 11, and later submitted a second. Wiz says it found its first vulnerability on August 19 and reported it to PHP on August 24.

According to the account, Calif used generally available models and no special testing harness. OpenAI said Calif found a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative. Wiz’s disclosure says it used its Wiz Atlas platform alongside Gemini 4 Argon and GPT-5.6 Sol. The PHP security team made the fixes; the source does not provide a full technical breakdown of the patches or affected versions.

The historical thread begins with a July 2004 advisory by Stefan Esser, which warned that PHP’s memory limit could terminate a request during an unsafe interruption. A 2019 PHP bug report later documented leftover temporary files after an out-of-memory failure; PHP fixed that issue in 2020 as a denial-of-service vulnerability. Calif’s account says auditors encountered a related out-of-memory issue in 2024, but exploitation was not proven. These episodes provide context, not proof that the older reports were the same defects fixed in 2026.

Why PHP2Shell Matters to Web Operators

PHP is used across a large part of the web, so remote code execution flaws in its runtime can matter well beyond a single application. The source says Wiz validated unauthenticated code execution against Drupal and WordPress during its research. That raises the stakes for operators running affected PHP versions, although the supplied material does not specify which versions are vulnerable or provide deployment guidance.

The episode also offers a grounded example of AI-assisted security research. The models were part of a process directed by researchers with knowledge of PHP’s history; the source does not support the claim that AI independently discovered every flaw or can find all bugs. For maintainers, the practical lesson is that older reports and unproven findings can guide later reviews, while fixes and clear version information remain necessary for users to respond.

From the 2004 Advisory to PHP2Shell

Esser’s 2004 advisory described a risk in how PHP handled a memory-limit interruption: if execution stopped while a structure was being prepared, cleanup could encounter an incomplete state. PHP fixed the specific paths in that report, according to the source. It says the wider problem of interruption at unsafe moments was harder to eliminate.

In November 2019, bug report #78876 described oversized multipart form fields causing an out-of-memory failure and leaving temporary files behind. PHP addressed it in May 2020, and the issue was assigned CVE-2019-11048 as a denial-of-service problem. The source also cites a 2024 PHP audit by Quarkslab with OSTIF and the PHP Foundation, reporting 27 findings and four CVEs. Calif says auditors rediscovered an out-of-memory issue, but the published OSTIF summary does not mention one, and the account says no exploit was demonstrated.

In summer 2026, Calif joined OpenAI’s Patch the Planet effort and focused on PHP. Its researcher Ryan Austin drew on the runtime’s vulnerability history to direct the review. Calif reported findings to PHP in August; Wiz’s separate investigation followed later that month. The fixes were released October 21.

““exploitation was not proven, hence the bug was not fixed.””

— Calif’s account of the 2024 audit

Affected Versions and Technical Scope

The source confirms that PHP released fixes for CVE-2026-109618 and CVE-2026-109619, but it does not list affected or patched PHP versions, the precise technical conditions for exploitation, or whether all supported branches received updates. It also does not establish that the 2004 advisory, the 2019 temporary-file issue, the 2024 audit finding and PHP2Shell share one underlying defect.

The supplied account gives partial disclosure timelines, but not the full advisories, patch details or a complete reconciliation of Calif’s and Wiz’s contributions to each CVE. Claims about model contributions are attributed to the organizations involved. Those claims do not show that AI tools acted independently of the researchers or that the same methods would find other vulnerabilities.

Patch Status and Disclosure Details

PHP operators should consult the PHP team’s security notices for the affected versions and corresponding fixed releases, then assess their own deployments. The source points readers toward a separate patch and restart guide but does not reproduce its instructions or state how widely the fixes have been applied.

Further PHP advisories and disclosures from Calif and Wiz may clarify the technical causes, affected branches, and how the separate research efforts map to the two CVEs. Until those details are available in the materials provided, the confirmed development is the October 21 release of fixes—not a complete account of exposure across PHP installations.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, for which PHP shipped fixes on October 21, 2026.

Who found the vulnerabilities?

Calif and Wiz conducted separate investigations and reported PHP vulnerabilities in August 2026. The source describes both teams as using AI tools during their research, alongside researcher-led analysis.

Did AI find the flaws on its own?

The source does not support that conclusion. It describes researchers choosing the target and directing the review, with models assisting parts of the work. Ryan Austin said, “No model is simply capable of unearthing ‘all bugs’.”

Are the 2026 flaws the same as the issue reported in 2004?

That is not established by the supplied account. The 2004 advisory and later out-of-memory reports are presented as historical context for a class of concerns, not as proof that all the reports describe identical vulnerabilities.

Which PHP versions need an update?

The source material does not list affected or fixed PHP versions. Operators should check the PHP security team’s official advisories for the version-specific release information before deciding what to update.

Source: ThorstenMeyerAI.com