From Historical PHP Code To PHP2Shell: An AI-Assisted Review

🔍 Read the full analysis: From Historical PHP Code To PHP2Shell: An AI-Assisted Review on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on monitors, keyboards and dev gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

PHP shipped fixes on October 21, 2026, for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. The vulnerabilities were found through separate research efforts by Calif and Wiz, which used AI tools as part of their reviews of PHP, a runtime used by a large share of websites. The discovery highlights how researchers can combine AI-assisted searching with security knowledge stretching back decades.

Calif’s account traces one line of investigation to PHP’s older vulnerability history. Researcher Ryan Austin selected PHP as a target, drawing on familiarity with its earlier bugs and forming a theory about where similar weaknesses might remain. Calif says the work did not use a special testing harness or models beyond those generally available. OpenAI separately said Calif found a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative.

Calif says it identified several paths to remote code execution on August 1, then reported its first vulnerability to PHP on August 11. It shared a proof of concept on August 14, and PHP confirmed the report the next day. Calif reported a second flaw on August 21. The chronology and technical description here are based on Calif’s published account; PHP’s fixes are the confirmed outcome described in the source material.

Wiz Research worked separately, according to its disclosure. It says it found its first vulnerability on August 19 using its Wiz Atlas platform alongside Gemini 4 Argon and GPT-5.6 Sol. Wiz reported confirming unauthenticated code execution against Drupal on August 20 and WordPress on August 21, before reporting the issue to PHP on August 24. The two teams’ parallel findings involved the same broad class of flaw, but the source material does not establish that they found identical exploit paths.

AI Aided a History-Led PHP Review

The findings matter because remote code execution can let an attacker run code on a vulnerable server, making flaws in a widely used runtime relevant beyond a single application. PHP’s release of fixes gives operators a clear action: consult the official security advisories, apply the appropriate updates and check systems that depend on PHP.

The research also offers a more specific lesson than the claim that AI independently discovers vulnerabilities. Calif’s account describes a human-led process: Austin chose a familiar target, used its past security record to guide the search and then worked with AI tools. That approach can help researchers explore a hypothesis, but it does not establish that models can find every flaw or replace expert review. Wiz’s separate discovery shows that more than one team was investigating PHP at the same time, using different platforms and models.

From a 2004 Warning to PHP2Shell

Calif’s retelling connects the 2026 research to a 2004 advisory by Stefan Esser of e-matters. The advisory warned that PHP’s memory-limit termination could occur at an unsafe point in request handling and, under particular conditions, create a route to code execution. PHP addressed the specific paths reported then, but the broader concern—what happens when a request is interrupted while internal state is only partly prepared—remained relevant to later security work.

A 2019 PHP bug report described large multipart form fields causing an out-of-memory failure and leaving temporary files behind. PHP fixed that issue in May 2020; it was assigned CVE-2019-11048 as a denial-of-service vulnerability. Calif presents it as a clue in its later review, not as proof that the 2019 bug itself enabled remote code execution.

Calif also says a 2024 audit rediscovered the out-of-memory issue but did not prove exploitation. The published audit summary cited in the source material lists 27 findings and four CVEs, all resolved, and does not mention that out-of-memory issue. That difference in accounts should be kept clear: the claim about rediscovery comes from Calif, while the audit summary is a separate published record.

“No model is simply capable of unearthing ‘all bugs’.”

— Ryan Austin, Calif researcher, as quoted in Calif’s write-up

Patch Scope and Exposure Details

The source material does not specify which PHP versions are affected, the exact technical mechanics of each vulnerability, or how many servers remain unpatched. Those details should be checked in PHP’s official advisories rather than inferred from the research narrative. It also does not provide evidence that the flaws were exploited in real-world attacks.

The relationship between the two CVEs and the independently reported findings needs care: Calif and Wiz describe separate research efforts, but the supplied account does not map each team’s findings to each CVE or establish that the teams’ vulnerabilities were technically identical. Calif’s claim about the 2024 audit also differs from what appears in the audit summary cited in the material. The full record behind that discrepancy is not provided.

Operators Should Check PHP Advisories

PHP operators should use the project’s security advisories to identify affected releases and the correct fixed versions, then update systems and verify that the deployed PHP runtime is running the patched release. Organizations should also check which applications and services depend on PHP, including hosted platforms such as Drupal or WordPress, without assuming that updating an application alone updates the underlying runtime.

Further details may come from PHP’s advisories and technical disclosures by Calif and Wiz, including clearer version ranges and vulnerability mechanics. The available material does not give a timetable for additional disclosures or report on patch adoption. For now, the confirmed development is that PHP released fixes on October 21; the remaining operational question is whether affected deployments have applied them.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, for which PHP released fixes on October 21, 2026.

Who found the vulnerabilities?

Calif and Wiz Research reported findings after separate investigations. Their published accounts describe different research timelines and AI tools; the supplied material does not show that both teams found identical exploit paths.

Did AI find the bugs on its own?

No such conclusion is established by the source material. Calif describes a researcher choosing a target and directing an AI-assisted review, while Wiz says it used its platform with Gemini and GPT models. Calif researcher Ryan Austin said no model can find all bugs.

Were the vulnerabilities exploited in attacks?

The source material does not report confirmed real-world exploitation. It describes research testing, including Wiz’s reported confirmation of unauthenticated code execution against Drupal and WordPress.

What should PHP users do?

Check PHP’s official advisories for affected versions and apply the appropriate fix. The supplied source does not list version ranges, so operators should rely on the project’s current guidance rather than assume a particular release is affected or safe.

Source: ThorstenMeyerAI.com