Why The PHP2Shell Story Took 22 Years—and How AI-Assisted Review Helped

🔍 Read the full analysis: Why The PHP2Shell Story Took 22 Years—and How AI-Assisted Review Helped on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get hardware and tech essentials delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP released fixes on October 21, 2026, for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, now called PHP2Shell. Researchers at Calif and Wiz found vulnerabilities in the widely used web runtime through separate investigations that drew on an issue class documented in 2004, with AI tools assisting parts of the review.

The vulnerabilities could allow remote code execution, according to the source account, which says Calif found several independent paths to that outcome and Wiz separately identified a related flaw. Calif reported its first issue to the PHP security team on August 11, sent a proof of concept on August 14, and received confirmation on August 15. It reported a second issue on August 21. Wiz reported its finding to PHP on August 24.

Wiz’s disclosure says it used its Wiz Atlas platform alongside Gemini 4 Argon and GPT-5.6 Sol. The account says Wiz validated unauthenticated code execution against Drupal on August 20 and WordPress on August 21. Calif’s Ryan Austin described a different emphasis: a researcher with knowledge of PHP’s history selected the target and guided the search, using AI to help examine it. OpenAI said Calif used GPT-5.6 Sol as part of its Patch the Planet initiative.

The fixes were made by the PHP security team. The source material does not provide affected-version details or patch instructions, so PHP users should consult official PHP advisories for the versions and remediation steps relevant to their installations.

Why PHP’s Old Bug Class Matters

PHP powers a large share of websites and web applications, so vulnerabilities in its runtime can affect software built on top of it. The reported ability to achieve remote code execution makes the flaws consequential: successful exploitation could let an attacker run code on a vulnerable server. The source material does not establish that attacks occurred in the wild.

The story also offers a more specific lesson about AI-assisted security work than the claim that models can find bugs on their own. Calif’s account credits researcher direction and historical knowledge with helping focus the review on an old, difficult-to-reason-about failure mode. AI tools assisted the investigation, but the available account does not show that they independently discovered or explained the entire vulnerability class.

From a 2004 Warning to PHP2Shell

In July 2004, security researcher Stefan Esser published an advisory warning that a remote attacker could trigger PHP’s memory-limit termination at a point where interrupting execution was unsafe. The concern was that PHP might be left with a partly built structure when cleanup began, potentially turning an ordinary out-of-memory failure into a security issue. PHP fixed the specific paths Esser reported, but the broader difficulty of handling interruptions safely remained part of the history described in the source.

A later clue appeared in PHP bug tracker report #78876, filed in November 2019. It described very large multipart form fields causing an out-of-memory condition and leaving temporary upload files behind. PHP fixed that issue in May 2020; it was assigned CVE-2019-11048 and treated as a denial-of-service problem because leftover files could consume disk space. Calif’s account presents it as a clue to what else an out-of-memory event might leave in an unsafe state.

Quarkslab audited PHP in 2024 with OSTIF and the PHP Foundation. Calif says the audit encountered the same out-of-memory issue, but exploitation was not proven. That account should be distinguished from OSTIF’s published summary, which lists 27 findings and four CVEs but, according to the source material, does not mention the out-of-memory issue. The reported history helps explain why a finding’s impact and exploitability matter as much as identifying a suspicious behavior.

“possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe”

— Stefan Esser, in his July 2004 security advisory

What the Disclosures Do Not Establish

The source material does not specify which PHP versions are affected, how widely the flaws can be exploited across different deployments, or whether either vulnerability has been used in real-world attacks. It also does not provide technical details sufficient to compare the two CVEs or explain whether they share exactly the same exploitation conditions.

Some parts of the long history rely on Calif’s account rather than the cited public audit summary. In particular, Calif says the 2024 audit rediscovered an out-of-memory issue, while the summary described in the source does not mention it. The account says exploitation was not proven then; it does not establish that the audit finding was identical in every respect to the flaws fixed in 2026.

Patch Status and Disclosure Details

PHP’s fixes are available from the project, but the source material does not list the patched release numbers or supported-version coverage. Administrators should check PHP’s official security advisories and update affected installations according to the project’s guidance. They should also review the PHP versions used by their applications and hosting environments; upgrading the runtime may require coordination with application dependencies.

Further public disclosures may clarify the technical differences between CVE-2026-109618 and CVE-2026-109619, affected configurations and any evidence of exploitation. Until those details are available, the confirmed development is the release of PHP fixes and the researchers’ account of how historical code knowledge and AI-assisted review contributed to finding the flaws.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, for which PHP shipped fixes on October 21, 2026.

Why did the story take 22 years?

The source account traces the relevant bug class to a 2004 advisory about memory-limit interruptions occurring at unsafe moments. A 2019 out-of-memory bug report and later review helped bring attention back to related cleanup and interruption behavior. The elapsed time does not mean the exact 2026 flaws were continuously known or proven exploitable for 22 years.

Did AI find the vulnerabilities by itself?

No such conclusion is established by the source. Calif’s account describes a researcher choosing the target and directing the review using knowledge of PHP’s vulnerability history, with AI assisting the search. Wiz also reported using AI models and its security platform.

Were the vulnerabilities exploited in attacks?

The source material does not report confirmed real-world exploitation. It describes validation of code execution in test environments and the reporting of the vulnerabilities to PHP, but does not establish that attackers used them against live systems.

What should PHP operators do?

Check PHP’s official advisories for the affected versions and apply the project’s fixes as directed. The source material does not list patched release numbers, so operators should verify coverage against their specific PHP installations and deployment requirements.

Source: ThorstenMeyerAI.com