How AI-Assisted Review Connected The Dots In The PHP2Shell Story

🔍 Read the full analysis: How AI-Assisted Review Connected The Dots In The PHP2Shell Story on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get audio and creator gear delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP shipped fixes on October 21, 2026, for two critical remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619, described in the source account as PHP2Shell. The research involved Calif, OpenAI and Wiz, and the account says AI tools helped researchers connect the vulnerabilities to a long-running concern about unsafe interruption of PHP requests; the fixes were made by the PHP security team.

Calif’s October 22 account traces the issue to a security warning published in July 2004. Stefan Esser of e-matters said PHP’s memory limit could terminate a request at a point where interruption was unsafe, potentially enabling code execution on remote servers. PHP fixed the specific paths in that advisory, but Calif presents the broader risk—an interruption during unfinished setup—as a continuing line of inquiry.

A later clue appeared in PHP bug #78876, filed on November 28, 2019. The report described large multipart form fields causing an out-of-memory condition and leaving temporary upload files behind. PHP fixed the issue in May 2020; it received CVE-2019-11048 and was treated as a denial-of-service vulnerability because leftover files could fill a disk. Calif’s retrospective says the behavior prompted a further question: what other state might remain after an out-of-memory failure?

In Calif’s timeline, researcher Ryan Austin pursued that question in 2026, drawing on his knowledge of PHP and its vulnerability history. Calif says it found several independent routes to remote code execution on August 1, reported a first bug to PHP on August 11, supplied a proof of concept on August 14, and received confirmation the next day. It reported a second bug on August 21. Wiz Research worked separately: its disclosure says it found a PHP vulnerability on August 19 and tested unauthenticated code execution against Drupal and WordPress before reporting it to PHP on August 24. The supplied account does not specify which discovery maps to each CVE.

Why Old PHP Bugs Mattered Again

The account’s main point is not that an AI system independently found a vulnerability. It describes researchers using AI as an aid while bringing their own knowledge of PHP’s older bugs and likely failure points. That distinction matters as organizations assess claims about automated vulnerability discovery: the human choice of target and theory shaped the search, while models helped with parts of review and validation.

The vulnerabilities matter because PHP is used to run web applications, and the account reports remote code execution—an outcome that can allow an attacker to run code on a vulnerable server. Wiz says it validated unauthenticated code execution against Drupal and WordPress. That makes the fixes relevant to PHP operators and teams responsible for applications built on those platforms. Whether a particular installation is exposed depends on details not supplied here, including affected versions and deployment conditions.

The timeline also shows why an issue once classified as denial of service may deserve renewed scrutiny when researchers examine its underlying behavior. A prior finding is not proof that a later exploit exists, and Calif’s account does not establish that the 2019 bug itself was exploited. Rather, it presents the old report as a clue that informed a new investigation.

From 2004 Advisory to 2026 Fixes

Esser’s 2004 advisory, identified in the source as CAN-2004-0594, described the risk of PHP reaching its memory limit during an unsafe operation. The underlying concern was that cleanup could run while a data structure or other state was only partly prepared. The advisory’s specific paths were fixed, but Calif’s retrospective argues that the general class of interruption problems remained worth investigating.

In 2024, PHP was audited by Quarkslab with OSTIF and the PHP Foundation. The published results listed 27 findings and four CVEs, all resolved, according to the source. Calif says auditors encountered the out-of-memory issue again but did not prove exploitation. OSTIF’s summary, as described in the account, does not mention that issue. Those details are not independently reconciled in the supplied material, so the audit episode should be treated as Calif’s account rather than a confirmed finding in the published summary.

For the 2026 work, Calif says it joined OpenAI’s Patch the Planet initiative and involved the PHP Foundation through Volker Dusch. Austin’s write-up says the effort used no special harness and no models beyond those generally available at the time. OpenAI identified GPT-5.6 Sol as part of Calif’s work. Separately, Wiz and Google’s security blog credited Gemini 4 Argon with contributing to vulnerability discovery, exploit development, attack detection and patch validation.

““possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe””

— Stefan Esser, in the 2004 security advisory quoted by Calif

What the Disclosures Do Not Settle

The supplied account does not provide the affected PHP versions, the exact technical mechanics of either 2026 vulnerability, or a mapping between CVE-2026-109618 and CVE-2026-109619 and the discoveries by Calif and Wiz. It also does not state how many servers or applications are exposed, whether either flaw has been exploited in the wild, or whether the PHP fixes require any additional action beyond updating.

The 2024 audit point remains qualified: Calif says auditors rediscovered an out-of-memory issue, while the published OSTIF summary reportedly does not list it. The source does not include the full audit record or a separate confirmation from the auditors. The role of AI is also described by the researchers and organizations involved; the material does not offer an independent comparison of how much the tools contributed relative to human analysis.

Patch Status and Further Disclosure

The immediate next step for PHP operators is to consult the PHP security team’s advisories and apply the fixes for the affected versions; the supplied source confirms that fixes shipped on October 21, 2026, but does not list version numbers or patch instructions. Administrators should check official PHP guidance and confirm that their deployed runtime has been updated.

Further technical disclosures may clarify the affected configurations, the relationship between the two CVEs and the separate research efforts, and whether any exploitation has been observed. Until that information is available, the confirmed development is the release of PHP fixes and the researchers’ reported findings—not a confirmed record of attacks against production systems.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used in the source account for two critical remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619. PHP shipped fixes on October 21, 2026.

Did AI discover the PHP vulnerabilities on its own?

The account describes AI-assisted research, not autonomous discovery. Calif researcher Ryan Austin said the researcher’s knowledge and choice of investigation direction mattered, and cautioned that no model can find all bugs.

What was the connection to the 2019 PHP bug?

Bug #78876 concerned an out-of-memory condition that left temporary upload files behind. Calif says it served as a clue for asking what other state could remain after a request ran out of memory. The supplied account does not say the 2019 issue was itself the 2026 exploit.

Were PHP2Shell flaws exploited in the wild?

The supplied material does not say. Wiz reported validating unauthenticated code execution against Drupal and WordPress during research, but that is not evidence that attackers used the flaws against live systems.

What should PHP administrators do?

Check the PHP security team’s official advisories for affected versions and apply the relevant fixes. The source confirms that fixes shipped but does not provide version-specific patch instructions.

Source: ThorstenMeyerAI.com