How To Understand PHP2Shell Through AI-Assisted Review

🔍 Read the full analysis: How To Understand PHP2Shell Through AI-Assisted Review on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on office and shipping supplies

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

PHP shipped fixes on October 21, 2026, for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. Research accounts from Calif and Wiz Research describe how AI tools assisted their investigations, while the work also drew on earlier PHP security research and human expertise.

According to Calif’s account, its researcher Ryan Austin found several independent paths to remote code execution on August 1, 2026. Austin published a hash of one finding on August 5, a way to establish that he had recorded it without disclosing the vulnerability. Calif says it reported one flaw to PHP on August 11, provided a working proof of concept on August 14, and received confirmation from PHP the next day. It reported a second bug on August 21.

Wiz Research worked independently, according to its disclosure post. It says it found its first PHP vulnerability on August 19 using the Wiz Atlas platform alongside Gemini 4 Argon and GPT-5.6 Sol. Wiz reported confirming unauthenticated code execution against Drupal on August 20 and WordPress on August 21, then notified PHP on August 24. These details are attributed to the researchers; the source material does not provide the PHP advisory text or a complete technical account of each flaw.

The supplied account says PHP’s security team fixed the vulnerabilities and identifies them as critical remote code execution flaws. It does not state which PHP releases contain the fixes, whether a specific configuration is required for exploitation, or how many systems may be exposed. Operators should consult PHP’s official security advisories for version-specific guidance rather than infer patch requirements from the research narrative.

Why PHP Runtime Flaws Matter

Remote code execution vulnerabilities can allow an attacker to run code on a vulnerable server. PHP is used widely across web applications, so flaws in the runtime can have consequences beyond one product. The researchers’ reports of code execution involving Drupal and WordPress illustrate why application operators may need to check not only their site software but also the PHP version underneath it.

The case also offers a grounded example of AI-assisted security research. Calif’s account says Austin chose a target he knew, used PHP’s history to form a theory, and did not rely on a special harness or models beyond those generally available. AI tools formed part of the search, but the reported process depended on a researcher directing that search and validating results. The finding does not establish that AI alone discovered the flaws or that similar tools will find every vulnerability.

From Memory Limits to PHP2Shell

The narrative in Calif’s write-up connects PHP2Shell to a class of problems involving interruptions during unsafe operations. In a July 2004 advisory, security researcher Stefan Esser warned that a remote attacker could trigger PHP’s memory-limit termination while the runtime was in a state where interruption was unsafe. The source says PHP fixed the specific paths Esser reported, while the wider class of risk remained difficult to eliminate.

A later clue appeared in PHP bug #78876, reported in November 2019. The report described large multipart form fields causing an out-of-memory condition and leaving temporary files behind. PHP fixed the issue in May 2020, and it was assigned CVE-2019-11048 as a denial-of-service vulnerability. Calif’s retrospective treats the leftover files as a prompt to ask what else an out-of-memory interruption might leave in an unsafe state.

Calif also says a 2024 audit rediscovered the out-of-memory issue but did not prove exploitation. The supplied material notes that the published audit summary does not mention that issue, so the account of the rediscovery is attributable to Calif, not independently established here. In summer 2026, Calif joined OpenAI’s Patch the Planet initiative, which the source describes as supporting security work on open-source software.

““possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe””

— Stefan Esser, in a July 2004 PHP security advisory, as quoted in Calif’s account

Patch Scope and Exposure Remain Unclear

The supplied material does not identify the affected PHP versions, the fixed release numbers, or whether the flaws require particular configurations or extensions. It also gives no estimate of how many servers remain vulnerable, whether either flaw has been exploited in the wild, or whether all related attack paths have been addressed. Those points should not be assumed from the description of the findings.

Some elements of the historical account are also claims by Calif rather than details independently supported in the supplied material. In particular, the account of the 2024 audit’s rediscovery is not reflected in the cited audit summary. The source describes separate research by Calif and Wiz, but does not provide enough technical detail to compare their findings or establish whether they reached the same exploit path.

Check PHP’s Advisories and Updates

PHP users should check the official security advisories for the affected releases and update to a fixed version where applicable. Application operators should verify the PHP runtime used by their production systems, including versions managed separately from Drupal, WordPress, or other web software, and follow their normal testing and deployment procedures.

Further details would be needed to establish the full scope of the vulnerabilities and the specific upgrade path for each deployment. PHP’s release notes and advisories, along with technical disclosures from Calif and Wiz, are the relevant sources to watch for version information, mitigation guidance, and any updates on exploitation or exposure.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used in the supplied account for two critical PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. The material does not include the full technical details of either vulnerability.

When did PHP release fixes?

The account says PHP shipped fixes on October 21, 2026. It does not specify the fixed PHP release numbers, so users should check PHP’s official advisories for applicable versions.

Did AI find the vulnerabilities by itself?

The research accounts describe AI tools as part of the investigations, not as independent discoverers. Calif’s account emphasizes Austin’s prior knowledge of PHP and his direction of the search; Wiz says it used its platform with Gemini and GPT models.

Are PHP2Shell flaws being exploited in the wild?

The supplied material does not say whether either vulnerability has been exploited in the wild. It describes researcher testing and disclosure, including reported code execution against Drupal and WordPress, but does not establish real-world attacks.

What should PHP operators do now?

Check PHP’s official security advisories for affected versions and upgrade guidance, then verify which PHP runtime serves each application. The source material does not provide enough information to name a specific version to install.

Source: ThorstenMeyerAI.com