PHP2Shell And AI: Revisiting A Security Story 22 Years In The Making

🔍 Read the full analysis: PHP2Shell And AI: Revisiting A Security Story 22 Years In The Making on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the little things that make your day delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP released fixes on October 21, 2026, for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. Researchers at Calif and Wiz found vulnerabilities in the runtime, with AI tools assisting parts of their work; the findings also revived a concern about unsafe out-of-memory interruptions first raised in a 2004 PHP advisory.

According to the account published by Thorsten Meyer, Calif found several independent paths to remote code execution on August 1. It reported one vulnerability to PHP on August 11, provided a working proof of concept on August 14, and received confirmation from PHP the next day. Calif reported a second flaw on August 21. The source identifies Calif, OpenAI and Wiz as receiving research credit, and says the fixes were made by the PHP security team.

Wiz Research worked separately. Its disclosure says it found its first PHP vulnerability on August 19 using its Wiz Atlas platform alongside Gemini 4 Argon and GPT-5.6 Sol. Wiz said it confirmed unauthenticated code execution against Drupal on August 20 and WordPress on August 21, then reported the issue to PHP on August 24. The source describes the two teams as reaching the same class of flaw within weeks, not as collaborating on a single discovery.

The underlying problem involved what could happen when PHP ran out of memory at an unsafe point while handling a request. Calif’s research connected the 2026 flaws to a broader class of interruptions that can leave program structures incompletely set up before cleanup runs. The supplied account does not provide technical exploit details or spell out which specific internal paths distinguish the two CVEs.

Why PHP Runtime Fixes Matter

PHP powers a large share of websites, and the reported flaws allowed remote code execution, a class of vulnerability that can let an attacker run code on a vulnerable server. The source says Wiz demonstrated unauthenticated code execution against Drupal and WordPress in testing. That makes the patch relevant beyond PHP specialists: website operators and hosting providers should establish whether their deployed PHP versions include the fixes and apply them.

The discovery also offers a measured example of AI-assisted security research. AI systems contributed to work by both teams, but the account does not establish that a model independently identified or resolved the vulnerabilities. Calif researcher Ryan Austin chose a familiar target and used knowledge of PHP’s vulnerability history to guide the search. The result points to a role for AI as a research aid alongside human direction, rather than evidence that models can find every flaw on their own.

From 2004 Advisory to 2026 Fixes

In July 2004, security researcher Stefan Esser published Bugtraq Advisory 11/2004, titled “PHP memory_limit remote vulnerability.” The advisory warned that a remote attacker could trigger memory-limit termination where interrupting execution was unsafe, potentially allowing code execution on PHP servers. PHP fixed the specific paths Esser reported, but the wider challenge of interruption at an unsafe moment remained relevant to later research.

A 2019 PHP bug report described large multipart form fields causing an out-of-memory failure and leaving temporary files behind. PHP fixed that issue in May 2020, and it received CVE-2019-11048 as a denial-of-service vulnerability. Calif later treated the leftover files as a clue about what other state might persist after an out-of-memory event. Separately, Calif says a 2024 audit rediscovered the issue, though exploitation was not proven. The audit summary cited in Meyer’s account does not mention an out-of-memory finding, so that part of the history remains attributable to Calif.

In summer 2026, OpenAI invited Calif to take part in Patch the Planet, an initiative to help open-source maintainers improve security. Calif’s write-up says Austin used generally available models and no special harness. The account names GPT-5.6 Sol in Calif’s work and describes Wiz using its own platform with Gemini 4 Argon and GPT-5.6 Sol.

What the Disclosures Do Not Establish

The supplied account does not include the PHP security team’s technical advisories, affected version ranges, patched release numbers, or deployment instructions. It also does not detail the exploit mechanics for either CVE. Operators should consult PHP’s official advisories to determine which versions require an update rather than infer that information from the research timeline.

The extent to which AI tools contributed to each specific discovery step is not fully documented here. Calif’s description says its researcher directed the work, while Wiz and Google credit Gemini 4 Argon with several research and validation tasks. The source also reports Calif’s account of a 2024 rediscovery, but says exploitation was not proven; the audit summary it references does not confirm that detail. Neither an unproven exploit nor an absent mention in that summary resolves what the auditors observed.

Apply Patches and Check Advisories

The immediate next step for PHP operators is to check the official PHP security advisories, identify whether their deployed releases are affected, and install the applicable fixes. Website owners relying on Drupal, WordPress or other PHP applications should confirm which PHP runtime their hosting environment uses; updating an application alone may not update PHP itself.

Further detail depends on technical advisories from PHP and any follow-up disclosures from the researchers. Those materials can clarify affected versions, the fixes’ scope and practical guidance for administrators. Until then, the confirmed development is that PHP shipped fixes for both named vulnerabilities on October 21, 2026; the full technical record and distribution of affected deployments are not established in the supplied source.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used for two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP released fixes on October 21, 2026.

Who found the vulnerabilities?

The source credits researchers at Calif and Wiz. Their research took place independently, and each team reported findings to PHP in August 2026.

How did AI tools figure in the research?

Calif’s work used GPT-5.6 Sol, according to the source, while Wiz described using its Wiz Atlas platform with Gemini 4 Argon and GPT-5.6 Sol. The account presents the tools as part of researcher-led work, not as proof that AI can find every vulnerability.

What should PHP operators do?

Check PHP’s official security advisories for the affected versions and install the applicable fixes. The supplied source does not list patched release numbers, so operators should not guess which versions are safe.

Source: ThorstenMeyerAI.com