How Researchers Revisited PHP2Shell’s 22-Year History With AI

🔍 Read the full analysis: How Researchers Revisited PHP2Shell’s 22-Year History With AI on ThorstenMeyerAI.com

PHP shipped fixes on October 21, 2026, for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. A retrospective published the next day by Thorsten Meyer says the vulnerabilities were found through separate research efforts involving Calif and Wiz, with AI tools assisting the work, and traces the underlying security concern to a 2004 advisory about memory-limit interruptions.

Meyer’s account says PHP’s security team fixed the two vulnerabilities after Calif and Wiz Research reported their findings. The bugs affect PHP, a widely used web programming language, and the researchers demonstrated remote code execution in tests involving applications built on PHP, including Drupal and WordPress, according to the timeline and disclosures summarized in the article. The source material does not provide the PHP release versions containing the fixes or a detailed technical description of each flaw.

According to Calif’s timeline, it identified several paths to remote code execution on August 1, 2026, reported its first bug to PHP on August 11 and supplied a working proof of concept on August 14. PHP confirmed that report the following day, and Calif reported a second bug on August 21. Wiz says it found a PHP vulnerability on August 19, validated unauthenticated code execution against Drupal on August 20 and WordPress on August 21, then reported its finding to PHP on August 24.

The report describes AI as part of the researchers’ workflow, not as an independent discovery process. Calif’s Ryan Austin chose the target and directed the search using knowledge of PHP’s history. Wiz’s disclosure says its team used the Wiz Atlas platform alongside Gemini 4 Argon and GPT-5.6 Sol. The research credit belongs to Calif, OpenAI and Wiz, while PHP’s security team made the fixes.

Why PHP2Shell’s History Matters

The account matters because it links a current remote-code-execution issue to a broader security problem that researchers had examined for years: what happens when PHP runs out of memory at an unsafe point in processing a request. A memory limit is intended to stop resource-intensive requests. But, as the 2004 advisory described, interrupting work partway through setup can leave software in a state that makes cleanup unsafe. The retrospective presents that history as a clue, not proof that every earlier report was exploitable in the same way.

It also offers a grounded view of AI-assisted vulnerability research. Calif’s account emphasizes that Austin selected the target and brought historical knowledge to the search. That matters to security teams and maintainers evaluating claims about automated bug finding: the reported work involved a human researcher, AI tools and follow-up validation, rather than a model independently uncovering and confirming vulnerabilities. The practical outcome is concrete: PHP released fixes, and affected deployments need to identify and apply the relevant updates.

From the 2004 Warning to 2026

In July 2004, Stefan Esser of e-matters published Bugtraq Advisory 11/2004, titled “PHP memory_limit remote vulnerability,” identified in the source as CAN-2004-0594. Esser warned that a remote attacker could trigger memory-limit termination where an interruption was unsafe, potentially allowing code execution. PHP fixed the specific paths described at the time, but the broader challenge of handling interruption during partially completed operations remained a concern.

A related clue appeared in PHP bug tracker report #78876, filed on November 28, 2019. It described large multipart form fields causing an out-of-memory condition and leaving temporary files behind. PHP fixed the issue in May 2020; it was assigned CVE-2019-11048 and treated as a denial-of-service issue because leftover files could consume disk space. Calif later said a 2024 audit had encountered the same out-of-memory issue, but that account says exploitation was not proven. The published audit summary cited by Meyer lists 27 findings and four CVEs, all resolved, and does not mention an out-of-memory issue.

Calif’s account says its work began after it was invited to OpenAI’s Patch the Planet initiative, which supports open-source maintainers. Austin drew on his familiarity with PHP and its older vulnerability history. The account says the team used no special harness and no models beyond those generally available. Separately, Wiz says it used its Atlas platform and two named models in its research. These details describe different teams’ methods and should not be read as evidence that one tool alone found or verified both flaws.

„possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe“

— Stefan Esser, in the 2004 advisory as quoted by Meyer

Open Questions on Scope and Exposure

The source material does not identify which PHP versions are affected, which exact releases contain the fixes, or how many servers or applications were exposed. It also does not provide the full technical details needed to compare CVE-2026-109618 with CVE-2026-109619. Readers should not assume that the 2019 denial-of-service issue and the 2026 remote-code-execution flaws are identical; the retrospective describes a historical connection involving out-of-memory behavior, but does not establish that equivalence.

The 2024 audit account also needs careful qualification. Calif says the auditors encountered the issue but could not prove exploitation, while the audit summary cited by Meyer does not list an out-of-memory finding. The available material does not resolve that difference. Nor does it report whether the 2026 flaws have been exploited in the wild or how many systems have installed the patches.

Patch Status and Disclosure Follow-Up

PHP users should consult PHP’s security advisories and release information to determine whether their installed versions need updating, then apply the relevant fixed releases. Meyer points readers to a separate patch-and-restart guide, but the source material supplied here does not list release numbers or confirm a specific remediation window.

Further details from PHP, Calif and Wiz may clarify affected versions, technical differences between the two CVEs, and whether any exploitation has been observed. Until those details are available, the confirmed development is that PHP shipped fixes on October 21 and that the researchers reported remote-code-execution findings. The retrospective’s longer history provides context for the research, while the extent of real-world exposure remains unreported in the material.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, for which PHP shipped fixes on October 21, 2026.

Who found the PHP2Shell vulnerabilities?

The account credits research to Calif and Wiz Research, with AI tools used in their work. PHP’s security team made the fixes. The source describes separate research timelines rather than a single joint discovery.

Did AI find the flaws on its own?

The report does not say that. Calif’s Ryan Austin selected the target and guided the search using knowledge of PHP’s vulnerability history. Wiz describes using its Atlas platform with Gemini 4 Argon and GPT-5.6 Sol, followed by testing and validation.

What does the 2004 advisory have to do with the 2026 flaws?

The retrospective connects them through the broader issue of memory-limit interruptions at unsafe points. It does not establish that the 2004 issue and both 2026 vulnerabilities are identical.

Are PHP2Shell attacks happening in the wild?

The source material does not say whether the flaws have been exploited outside testing. It also does not state how many systems were exposed. PHP users should check official security advisories for affected versions and fixes.

Source: ThorstenMeyerAI.com