The Long Road To PHP2Shell: Revisiting The Story With AI

🔍 Read the full analysis: The Long Road To PHP2Shell: Revisiting The Story With AI on ThorstenMeyerAI.com

Age 18–24?Offer from Amazon

Prime made for students and young adults

• Fast, free delivery for dorm and study essentials
• Prime Video and Amazon Music included
• Member-only deals

Try Prime for Young Adults →Free trial for eligible 18–24 year olds

As an affiliate, we earn on qualifying purchases.Hide

PHP released fixes on October 21 for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. A retrospective published the next day by Thorsten Meyer traces the flaws to a long-running security concern and describes separate investigations by Calif and Wiz Research that used AI tools alongside human analysis.

Meyer’s account frames PHP2Shell as more than a story about recently released AI models. It follows a trail from a 2004 security advisory, through a 2019 PHP bug report about out-of-memory failures and temporary files, to research that led to the 2026 vulnerabilities. The underlying concern is that a request interrupted at an unsafe point may leave partially prepared data structures or other state for cleanup code to handle.

According to the retrospective, Calif identified several possible paths to remote code execution in August 2026 and reported two findings to PHP. Its timeline says the first report went to the PHP team on August 11, followed by a working proof of concept on August 14; PHP confirmed it the next day. Calif reported a second issue on August 21. Wiz Research says it found a PHP vulnerability on August 19, validated unauthenticated code execution against Drupal and WordPress in the following days, and reported it to PHP on August 24.

The account says the PHP security team made the fixes, released on October 21. It does not provide enough technical detail to establish precisely how the two vulnerabilities differ, which PHP versions are affected, or what administrators should do beyond applying the relevant fixes. The retrospective points readers seeking remediation to a separate patch-and-restart guide.

Why PHP Runtime Security Matters

PHP runs a large share of web applications, and the reported ability to execute code remotely could have serious consequences if vulnerable deployments are exposed. The account’s references to validation against Drupal and WordPress illustrate why runtime flaws can matter beyond PHP specialists: applications built on the language may depend on its behavior. The source does not quantify affected installations or report confirmed exploitation in the wild.

The retrospective also offers a qualified account of AI’s role in security research. It attributes meaningful assistance to models and research platforms, but describes the process as guided by researchers’ experience with PHP and its older bug history. That distinction matters when interpreting claims about automated vulnerability discovery: the reported work does not establish that AI independently found the flaws or can identify all vulnerabilities.

From a 2004 Warning to PHP2Shell

In July 2004, security researcher Stefan Esser published an advisory about PHP’s memory limit. As quoted in Meyer’s account, Esser warned that an attacker could trigger request termination at a point where interruption was unsafe, potentially enabling code execution. PHP fixed the specific paths identified then, but the retrospective says the wider class of risk—failure during sensitive operations—proved harder to eliminate.

A PHP tracker report filed on November 28, 2019, described large multipart form fields causing out-of-memory failures and leaving temporary files behind. PHP fixed that issue in May 2020; it received CVE-2019-11048 and was treated as a denial-of-service problem. Calif later viewed the leftover files as a clue to ask what other state might survive an out-of-memory event.

The 2024 PHP audit, conducted by Quarkslab with OSTIF and the PHP Foundation, listed 27 findings and four CVEs, according to Meyer. His account says Calif reported that auditors had again seen the out-of-memory issue, but that exploitation was not proven. OSTIF’s published summary does not mention that issue, so the retrospective’s account of the audit finding should be treated as an attributed claim, not as a detail confirmed by that summary.

“possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe”

— Stefan Esser, in his July 2004 advisory, as quoted by Thorsten Meyer

Affected Versions and Exploitation Status

The supplied retrospective does not specify which PHP versions contain the flaws, the exact vulnerability mechanics, or the complete set of affected products and configurations. It also does not report whether attackers exploited either flaw before the fixes became available. The claims about Calif’s findings and Wiz’s validation are presented through the retrospective and cited research announcements; full technical advisories are not included in the source material.

The account says Calif and Wiz reached the same class of flaw independently, but the supplied timeline does not fully explain how their findings overlap or map to the two CVE identifiers. It is also unclear how widely PHP2Shell has been adopted as a name beyond the coverage described by the author.

Patch Guidance and Disclosure Details

PHP users should consult the PHP security team’s release information to identify affected versions and apply the appropriate fixes. Meyer’s article directs administrators to a separate guide covering patching, restarting services, and checking deployments; the supplied material does not reproduce its steps or the official release notes.

Further clarity depends on the PHP team’s advisories and technical disclosures from Calif and Wiz. Those materials can establish the precise scope of the vulnerabilities, how the fixes address them, and whether there is evidence of exploitation. Until then, the confirmed development is that PHP shipped fixes on October 21, 2026; operational details remain incomplete in the retrospective.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used in the retrospective for two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP released fixes on October 21, 2026.

Who found the vulnerabilities?

The account credits research to Calif, OpenAI and Wiz. It describes Calif and Wiz as investigating separately, with AI models or platforms assisting parts of their work.

Did AI discover PHP2Shell on its own?

The source does not support that conclusion. It describes researchers choosing targets and drawing on prior knowledge, with AI tools contributing to the investigations. Calif’s Ryan Austin cautioned that no model can find all bugs.

Are PHP2Shell flaws being exploited?

The supplied account does not say whether either flaw was exploited in the wild. It reports testing of unauthenticated code execution against Drupal and WordPress, which is not the same as evidence of real-world attacks.

What should PHP administrators do?

Check the PHP security team’s release information for affected versions and apply the relevant fix. The retrospective also points to a separate guide on patching, restarting, and checking a PHP deployment.

Source: ThorstenMeyerAI.com