The 22-Year Road To PHP2Shell: How AI-Assisted Review Finished An Old Story

🔍 Read the full analysis: The 22-Year Road To PHP2Shell: How AI-Assisted Review Finished An Old Story on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

PHP shipped fixes on Oct. 21, 2026, for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, described in the source account as PHP2Shell. The discoveries involved research by Calif and Wiz, with AI tools assisting researchers; the episode also revived attention to a PHP security concern first raised in a 2004 advisory.

Calif’s account says its researcher, Ryan Austin, reported a first vulnerability to PHP on Aug. 11, 2026, sent a working proof of concept on Aug. 14, and received confirmation from PHP on Aug. 15. Calif reported a second flaw on Aug. 21. The account says the research found multiple independent paths to remote code execution, though the supplied material does not provide technical details sufficient to explain how the vulnerabilities work.

Wiz Research worked separately, according to its disclosure post. It says it found its first PHP vulnerability on Aug. 19, confirmed unauthenticated code execution against Drupal on Aug. 20 and WordPress on Aug. 21, then reported the issue to PHP on Aug. 24. The source material identifies the two PHP flaws as critical, but does not specify which discovery maps to each CVE or provide affected versions and patch details.

The research drew on AI tools as well as human expertise. Calif’s account says Austin used generally available models and no special harness. OpenAI said Calif found a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative. Wiz and Google said Gemini 4 Argon contributed to vulnerability discovery, exploit development, attack detection and patch validation. These are statements by the organizations involved, not an independent evaluation of the tools.

Why PHP Runtime Fixes Matter

Remote code execution can allow an attacker to run code on a vulnerable server, making flaws in widely used web infrastructure consequential for site operators and service providers. The supplied account describes PHP as running behind a large share of the web, but gives no measurement or date for that characterization. Organizations using PHP should consult official PHP advisories and apply the relevant fixes; the source article points readers to a separate patch and restart guide, but its instructions are not included here.

The episode also illustrates a bounded role for AI in security research: it may help researchers search, test or validate a theory, while people supply target knowledge and judgment. Calif’s account emphasizes that the researcher selected a vulnerability direction based on prior knowledge. That is different from evidence that an AI system can independently find all vulnerabilities or reliably assess every risk.

From 2004 Advisory to 2026 Fixes

In July 2004, Stefan Esser of e-matters published Bugtraq Advisory 11/2004, titled “PHP memory_limit remote vulnerability,” and associated with CAN-2004-0594. The advisory warned that a remote attacker could trigger PHP’s memory-limit termination at a point where interruption was unsafe, potentially enabling code execution. PHP fixed the specific paths discussed at the time. Calif’s retelling connects that warning to a broader concern about what happens when execution stops during incomplete setup and cleanup.

A later report offered a related clue, though it was handled as a different issue. PHP bug #78876, filed on Nov. 28, 2019, described large multipart form fields causing an out-of-memory condition and leaving temporary files behind. PHP fixed it in May 2020, and it received CVE-2019-11048 as a denial-of-service issue. Calif says a 2024 audit rediscovered the out-of-memory problem but did not prove exploitation. The published audit summary, according to the supplied material, lists 27 findings and four CVEs and does not mention that issue.

Calif’s account says OpenAI invited the team to Patch the Planet on July 30, 2026, and that the PHP Foundation was brought into the work through Volker Dusch. It describes the 2026 research as returning to an old class of concerns rather than treating the earlier advisory and bug report as proof of the newly disclosed vulnerabilities.

““possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe””

— Stefan Esser, in the July 2004 advisory as quoted by Calif

Technical Scope Still Unreported

The source material does not include PHP’s advisories or the technical descriptions needed to establish which versions are affected, how the two CVEs differ, or whether every PHP deployment is exposed. It also does not provide the patch versions, exploitation conditions, or evidence of attacks in the wild. Those details should not be inferred from the “PHP2Shell” label or from the critical severity description.

The historical connection is presented chiefly through Calif’s account. The available material does not show that the 2004 advisory, the 2019 bug or the reported 2024 audit finding was the same vulnerability as either 2026 CVE. Nor does it reconcile the separate discovery timelines in full. The AI contributions are attributed to the teams and companies involved; comparative performance claims and the models’ precise roles remain unverified here.

Patch Status and Disclosure Details

PHP has shipped fixes, but operators need the official PHP release advisories to determine whether their installations are affected and which patched release to install. The supplied source does not state the release numbers or describe subsequent PHP guidance. Administrators should check PHP’s official security notices, update affected installations, and follow their normal restart and verification procedures.

Further disclosures from PHP, Calif, Wiz and the participating AI providers may clarify the vulnerabilities’ technical scope, affected versions, patch validation and the relationship between the parallel research efforts. Until those details are available, the confirmed development is the release of fixes for two critical remote code execution flaws, not a complete public account of every exposure or the role of each AI tool.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used in the source account for two critical remote code execution vulnerabilities fixed by PHP on Oct. 21, 2026: CVE-2026-109618 and CVE-2026-109619.

Who found the vulnerabilities?

The supplied account credits research by Calif and Wiz. Calif reported findings to PHP in August, while Wiz says it independently found and reported a vulnerability. The source also identifies OpenAI and Wiz research efforts involving AI tools.

Which PHP versions need an update?

The source material does not list affected versions or patched release numbers. Check the official PHP security advisories for the version-specific guidance before deciding whether an installation is affected.

Did AI discover the flaws on its own?

The organizations involved describe AI tools as assisting the research, but Calif’s account says the researcher chose the target and guided the work using knowledge of PHP’s vulnerability history. The material does not support a claim that an AI system found the flaws independently.

Were the 2026 flaws known since 2004?

That is not established. Calif’s account connects the research to a security concern described in a 2004 advisory, but the supplied material does not show that either 2026 CVE is the same bug as the earlier issue.

Source: ThorstenMeyerAI.com