What AI-Assisted Review Revealed About The Long Road To PHP2Shell

🔍 Read the full analysis: What AI-Assisted Review Revealed About The Long Road To PHP2Shell on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

PHP released fixes on October 21, 2026, for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. A retrospective published the next day says researchers at Calif and Wiz used AI-assisted review while investigating PHP’s security history, connecting the new vulnerabilities to a longer-running problem involving unsafe interruptions when the runtime runs out of memory.

The account, published by Thorsten Meyer on October 22, describes a research effort shaped by both older security findings and current AI tools. Calif researcher Ryan Austin selected PHP as a target, drawing on his familiarity with its history and a theory about where vulnerabilities might remain. The write-up says the work did not use a special testing harness or models beyond those generally available. OpenAI separately said Calif used GPT-5.6 Sol as part of its Patch the Planet initiative.

According to Calif’s timeline, it found several independent paths to remote code execution on August 1, 2026. Austin published a hash of one finding on August 5, then reported the first flaw to PHP on August 11 and shared a proof of concept on August 14. PHP confirmed it on August 15, Calif reported a second flaw on August 21, and the team says PHP’s fixes were shipped on October 21.

Wiz Research worked in parallel, according to its disclosure post. It says it found its first PHP vulnerability on August 19 using Wiz Atlas alongside Gemini 4 Argon and GPT-5.6 Sol. Wiz reported confirming unauthenticated code execution against Drupal on August 20 and WordPress on August 21, then reported the issue to PHP on August 24. The supplied account identifies both teams’ work but does not fully explain how their findings map to each CVE.

Why PHP Runtime Security Matters

PHP is used to run a large share of websites and web applications, so remote code execution flaws can matter beyond the runtime itself. The reported tests against Drupal and WordPress illustrate the potential reach of a weakness in PHP, although the source does not specify the full set of affected configurations or installations. The release of fixes gives operators a concrete action: apply the relevant PHP updates and check their deployments against official guidance.

The research also offers a more limited takeaway about AI-assisted security work. In this account, AI tools supported researchers rather than independently discovering every issue. Austin’s knowledge of PHP’s history helped focus the search, while separate researchers at Wiz used their own platform and models. That distinction matters as software teams judge claims about what AI can find: the report describes a human-led investigation with model assistance, not proof that a model can locate all bugs or replace security expertise.

From a 2004 Warning to PHP2Shell

The retrospective traces the issue class back to July 2004, when Stefan Esser of e-matters published an advisory about PHP’s memory limit. Esser warned that an attacker could trigger request termination at a point where interruption was unsafe, potentially allowing code execution. PHP fixed the specific paths described then, but the broader concern was how a sudden stop could leave partially constructed data in a state that cleanup routines did not handle safely.

A later clue appeared in PHP bug #78876, reported in November 2019. The report said that oversized multipart form fields could cause an out-of-memory condition and leave temporary upload files behind. PHP fixed the issue in May 2020, and it received CVE-2019-11048 as a denial-of-service vulnerability. Calif’s account interprets the leftover files as a reason to ask what else might persist after memory exhaustion; that interpretation is not itself proof that the older bug enabled code execution.

The article also says a 2024 PHP audit by Quarkslab, with OSTIF and the PHP Foundation, listed 27 findings and four CVEs, all resolved. Calif says the auditors had rediscovered the out-of-memory issue but did not prove exploitation, so it was not fixed then. OSTIF’s published summary, as described in the article, does not mention that issue. The accounts are not identical, and the retrospective attributes the rediscovery detail to Calif.

““possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe””

— Stefan Esser, in his July 2004 security advisory, as quoted in the retrospective

What the Disclosures Do Not Resolve

The supplied account does not detail the complete technical mechanics of either vulnerability, the affected PHP versions, or the exact configurations required for exploitation. It also does not establish how the two CVEs correspond to Calif’s and Wiz’s separate findings, or whether the teams independently identified the same flaw, related flaws, or different paths within the same class.

The claims about the 2024 audit require care: Calif says the issue was rediscovered, while the article says OSTIF’s public summary does not mention it. The account does not provide the underlying audit records needed to reconcile those descriptions. The research timelines and AI tools used are attributed to the teams and organizations involved; the retrospective does not provide an independent technical review of their contributions.

Patch Adoption and Disclosure Details

PHP operators should consult the official PHP security advisories and upgrade to a fixed release appropriate to their deployment. The retrospective says the fixes shipped October 21, but readers should use PHP’s release information—not the article alone—to confirm affected versions and patch instructions. Service owners may also need to check the PHP version used by their web applications and hosting environment.

Further clarity depends on the full advisories and technical disclosures: which releases are vulnerable, how the flaws can be reached in specific deployments, and how each research team’s finding relates to the two CVEs. The supplied source does not give a later patch-adoption count or a confirmed timeline for additional disclosure.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used in the source account for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, for which PHP released fixes on October 21, 2026.

Who found the vulnerabilities?

The account credits research by Calif and Wiz Research. Calif’s and Wiz’s disclosures describe separate investigations; the supplied material does not fully map each team’s findings to the two CVE identifiers.

What role did AI play?

The teams reported using AI tools during security research. OpenAI says Calif used GPT-5.6 Sol, while Wiz says it used Gemini 4 Argon and GPT-5.6 Sol with its Wiz Atlas platform. The account presents the work as researcher-led and does not establish that AI found the vulnerabilities without human direction.

What should PHP users do?

Check the official PHP advisories for affected versions and upgrade to a fixed release that matches your deployment. The source does not provide enough detail to identify the affected version range or patch steps.

Was the issue already known in earlier audits?

Calif says an out-of-memory issue was rediscovered during a 2024 audit but exploitation was not proven. The retrospective says OSTIF’s public summary does not mention that issue, so the audit history is not fully reconciled in the material provided.

Source: ThorstenMeyerAI.com