🔍 Read the full analysis: AI-Assisted Review And The Unfolding Story Of PHP2Shell on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
PHP shipped fixes on Oct. 21, 2026, for two critical remote code execution flaws known as PHP2Shell. Calif and Wiz reported findings after separate AI-assisted research; the account traces the vulnerabilities to a longstanding class of risk involving out-of-memory interruptions. The precise relationship between the earlier bug reports and the newly fixed flaws, and the extent of exposure in real-world systems, are not fully established in the source material.
PHP released fixes on October 21, 2026, for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, described in the source account as PHP2Shell. Calif and Wiz researchers reported findings from separate investigations, with AI tools assisting parts of their work. The account connects the flaws to a class of risk involving out-of-memory interruptions that has featured in PHP security history for decades.
The source account credits Calif, OpenAI and Wiz with research related to the flaws, and says the PHP security team made the fixes. Calif researcher Ryan Austin’s investigation focused on PHP’s handling of out-of-memory conditions. The account says Calif reported one bug on August 11, shared a proof of concept on August 14, received confirmation from PHP on August 15, and reported a second bug on August 21.
Wiz Research worked independently, according to its disclosure timeline as summarized in the source. It says it found a PHP vulnerability on August 19, validated unauthenticated code execution against Drupal and WordPress in the following days, and reported the issue to PHP on August 24. The source says Wiz used its Wiz Atlas platform and two AI models in the investigation. These timelines describe separate research efforts; the available material does not fully detail how each finding maps to the two CVE identifiers.
The account says PHP’s fixes address two critical flaws that could allow remote code execution. It does not provide the affected PHP versions, patch-level instructions, or a complete technical description of the vulnerable code paths. Operators should consult PHP’s own security advisories for those details rather than rely on the historical narrative alone.
Infographic 01 · Timeline
One class of bug, four chances to catch it.
The flaws fixed on 21 October 2026 continue a line that starts with a 2004 advisory about unsafe interruptions.
- Jul 2004Stefan Esser: memory_limit can stop PHP “where an interruption is unsafe”Advisory 11/2004, CAN-2004-0594. Remote code execution was possible. (e-matters)
- 28 Nov 2019Bug #78876: long upload fields cause out-of-memory, temp files left behindFixed May 2020 as CVE-2019-11048, a denial-of-service issue at the time. (PHP bug tracker)
- 2024Quarkslab audit with OSTIF and the PHP FoundationAccording to Calif, it rediscovered the same OOM issue; exploitation was not proven, so it stayed open. (Calif, OSTIF)
- 30 Jul 2026Calif joins OpenAI’s Patch the Planet and picks PHPStefan Esser brings in the PHP Foundation through Volker Dusch. (Calif)
- 1–21 Aug 2026Calif finds several RCE paths and reports two bugs to PHPFirst report 11 Aug, working proof of concept 14 Aug, confirmed by PHP 15 Aug, second report 21 Aug. (Calif)
- 19–24 Aug 2026Wiz Research finds its first PHP flaw and reports on 24 AugUsing Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol; RCE confirmed on Drupal and WordPress. (Wiz)
- 21 Oct 2026PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 releasedCVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2. Public disclosure the same day. (PHP)
“…possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe.”Stefan Esser, e-matters Advisory 11/2004
Sources: e-matters Advisory 11/2004; PHP bug #78876; OSTIF; Calif: php2shell; Wiz Research (21 Oct 2026); PHP security advisory (21 Oct 2026).
Powered by Thorsten Meyer AI
Why PHP Runtime Fixes Matter
Remote code execution flaws can let an attacker run code on a vulnerable server, making these fixes relevant to organizations that use PHP for websites and applications. The source describes PHP as underpinning a large share of the web, but does not quantify the number of affected servers or say how many have been exploited. The practical priority is to identify affected deployments and apply the official fixes.
The research also draws attention to the limits of treating AI as an autonomous security auditor. AI tools assisted researchers, but the source’s account emphasizes Austin’s knowledge of PHP’s earlier vulnerabilities and his choice of where to investigate. That distinction matters to security teams evaluating whether models can replace expert review: the reported work supports a role for AI in guided research, not a claim that a model independently finds every flaw.
PHP security vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
A Long Trail of Memory-Limit Bugs
The account traces the issue to a warning from July 2004, when security researcher Stefan Esser published an advisory about PHP’s memory limit. He warned that a remote attacker might trigger request termination at a point where interruption was unsafe, potentially creating a route to code execution. PHP fixed the specific paths in that advisory, but the broader concern was that stopping execution midway through setup could leave partially prepared data for cleanup routines to handle.
A later clue appeared in PHP bug #78876, reported in November 2019. The report said oversized multipart form fields could cause an out-of-memory condition and leave temporary upload files behind. PHP fixed that issue in May 2020, and it received CVE-2019-11048 as a denial-of-service vulnerability. Calif’s retrospective treats the leftover files as a sign that memory exhaustion could have other consequences; that interpretation is not, by itself, proof that the earlier issue was exploitable for code execution.
The source also refers to a 2024 PHP audit conducted by Quarkslab with OSTIF and the PHP Foundation. Calif says auditors encountered the out-of-memory issue again, but exploitation was not demonstrated. OSTIF’s published summary, as described in the source, does not mention that issue. The distinction between a potential weakness and a proven exploit is central to the account—and remains important when interpreting the older findings.
As an affiliate, we earn on qualifying purchases.
Exposure and Exploit Details
The source material does not identify which PHP releases are affected, provide patch version numbers, or establish how widespread vulnerable deployments are. It also does not report confirmed exploitation in the wild. The claims about the 2024 audit’s rediscovery come from Calif’s account, while the audit summary cited in the source does not mention an out-of-memory issue.
The account links the newly disclosed flaws to a longer history of out-of-memory handling, but it does not supply enough technical detail to establish the precise relationship between the 2004 advisory, the 2019 denial-of-service bug and the two 2026 CVEs. Nor does it specify how much of each research effort was performed by people or AI systems. Those details should be treated as unresolved unless confirmed in the technical advisories or research write-ups.
out-of-memory error monitoring tool
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Patch Guidance and Further Disclosure
PHP users should check the official PHP security advisories for affected versions and apply the corresponding updates. The source says the fixes shipped October 21, but does not give upgrade commands or release numbers. Administrators should verify that the patched PHP runtime is the one actually serving production applications.
Further technical information may clarify the vulnerable code paths, the relationship between the two CVEs, and whether any exploitation has been observed. The separate Calif and Wiz disclosures, alongside PHP’s advisories, are the relevant sources for those updates. Until they provide more detail, the confirmed development is the release of fixes—not a quantified estimate of exposure or evidence of active attacks.
remote code execution prevention software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used in the source account for two critical remote code execution flaws fixed by PHP on October 21, 2026: CVE-2026-109618 and CVE-2026-109619.
Who found the vulnerabilities?
The source credits Calif and Wiz Research with separate findings and describes AI tools as part of their research processes. PHP’s security team made the fixes.
Does the source say attackers exploited the flaws?
No confirmed exploitation is reported in the supplied account. It does not establish whether the vulnerabilities were used in real-world attacks.
What should PHP operators do?
Check PHP’s official advisories for the affected versions and apply the matching fixes. The supplied account does not list version numbers or patch commands.
Did AI find the flaws without human direction?
The source describes AI-assisted research, not an autonomous discovery. It emphasizes researcher Ryan Austin’s knowledge of PHP’s history and his role in directing the investigation.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
