The 22-Year Path To PHP2Shell, Revisited With AI-Assisted Review

🔍 Read the full analysis: The 22-Year Path To PHP2Shell, Revisited With AI-Assisted Review on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on office and shipping supplies

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

PHP released fixes on October 21, 2026 for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now referred to as PHP2Shell. Calif and Wiz found flaws in separate research efforts that used AI tools, while Calif’s account traces the underlying security concern to a 2004 warning about PHP interruptions during unsafe operations. The disclosure matters because successful remote code execution can allow an attacker to run code on an affected server; the available source does not specify the full range of affected versions or technical conditions for exploitation.

According to the source account, Calif identified several independent paths to remote code execution on August 1, 2026. Researcher Ryan Austin published a hash of one finding on August 5, a way to establish that he had recorded it without disclosing the vulnerability itself. Calif says it reported one flaw to PHP on August 11, supplied a working proof of concept on August 14, and received confirmation on August 15. It reported a second flaw on August 21. The PHP security team made the fixes; the supplied material does not give patch numbers or a detailed account of the fixes.

Wiz Research worked independently, according to Calif’s timeline and Wiz’s disclosure. Wiz says it found its first PHP vulnerability on August 19 using its Wiz Atlas platform alongside Gemini 4 Argon and GPT-5.6 Sol. It reports confirming unauthenticated code execution against Drupal on August 20 and WordPress on August 21, before notifying PHP on August 24. These dates and platform details are attributed to the organizations’ accounts, not independently established in the material provided.

The research is presented as a collaboration involving Calif, OpenAI and Wiz, with fixes made by PHP’s security team. Calif’s write-up credits Ryan Austin with the research and writing; its comic story and poster were created by Michal Zalewski, with illustrations by Stephanie Cortes of Ibis Craft. The supplied article says its own illustrations are new and do not reproduce Calif’s comic. It also describes the account as an illustrated retelling inspired by Calif’s publication, rather than a technical advisory with complete patching instructions.

Why PHP2Shell Affects Server Security

Remote code execution is a serious server risk because it can let an attacker run commands or code on a vulnerable system. Wiz says it validated unauthenticated code execution against Drupal and WordPress, two widely used content-management systems. That is evidence of impact in those tests, as reported by Wiz; it does not establish that every PHP deployment or every installation of those platforms was vulnerable.

The story also illustrates a practical point about AI-assisted security work. The account credits models and research platforms with helping locate or validate bugs, but the process involved researchers who selected a target, drew on earlier vulnerability knowledge, investigated results and reported findings to maintainers. AI assistance is not evidence that a model independently found every flaw, nor does one reported effort establish how often such methods will produce useful results.

For maintainers and operators, the immediate significance is the availability of PHP fixes. Systems that use affected PHP releases may need attention, but the source material provided here does not identify the affected release range or state which deployments require which update. Operators should consult PHP’s official security advisories and release notes for that information rather than infer applicability from the research narrative.

From the 2004 Advisory to PHP2Shell

The history begins with Stefan Esser’s July 2004 advisory, published as Advisory 11/2004 on Bugtraq and associated with CAN-2004-0594. The advisory warned that a remote attacker could trigger PHP’s memory-limit termination at a point where interruption was unsafe, potentially enabling code execution. PHP fixed the specific paths Esser described, according to the source account. The account frames the broader issue as a risk of interruption during partially completed operations, not as proof that the 2004 vulnerability remained unpatched.

A later clue came in PHP bug #78876, filed on November 28, 2019. The report described large multipart form fields causing an out-of-memory condition and leaving temporary upload files behind. PHP addressed it in May 2020, and it received CVE-2019-11048. The issue was treated as denial of service because leftover files could consume disk space. Calif’s later interpretation is that the report raised a wider question about what state might remain after memory exhaustion; that interpretation should not be confused with proof that the 2019 issue enabled code execution.

The source also points to a 2024 PHP audit by Quarkslab with OSTIF and the PHP Foundation. Its published results listed 27 findings and four CVEs, all resolved, while OSTIF’s summary did not mention an out-of-memory issue. Calif says auditors had rediscovered the OOM issue but could not prove exploitation, so it was not fixed at that time. That account is attributed to Calif; the supplied material does not include the underlying audit record supporting that specific description.

Affected PHP Versions Remain Unspecified

The supplied source identifies the two CVEs and says PHP shipped fixes, but it does not list affected PHP versions, fixed release numbers, or configuration requirements. It also does not provide enough detail to explain the precise mechanism of each flaw or whether the two CVEs represent distinct exploit paths, related variants, or another relationship. Those technical distinctions should be checked against PHP’s advisories.

The relationship between the 2004 advisory, the 2019 temporary-file issue, the 2024 audit account and the 2026 vulnerabilities is presented as a historical thread in Calif’s retelling. The material does not establish that these were the same bug or that a vulnerability remained continuously present from 2004 onward. The account also reports findings and test results from the research teams; it does not supply independent confirmation of every step or claim.

The source text ends partway through its account of OpenAI’s announcement about Wiz. As a result, the complete disclosure history, any additional coordination between the teams, and the full scope of Wiz’s findings are not available here. No information is provided about exploitation in the wild, the number of affected servers, or whether PHP has issued additional guidance since the October 21 release.

Check PHP Advisories and Patch Status

The next practical step for PHP operators is to consult PHP’s official security advisory and release documentation to identify affected versions and the correct fixed release. They can then compare that guidance with the PHP versions running on their servers and follow their normal testing and deployment procedures. The research narrative alone does not identify which update applies to a particular system.

Further reporting can clarify the technical details behind CVE-2026-109618 and CVE-2026-109619, the full scope of vulnerable deployments, and whether either flaw was exploited outside controlled research. PHP or the research teams may also publish additional technical material. Until then, the confirmed development in the supplied account is that fixes were shipped on October 21; claims about the historical connection and individual research contributions remain attributed to the organizations and authors that reported them.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used for two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The supplied source says PHP shipped fixes on October 21, 2026, but does not include the technical advisories or affected version list.

Who found the PHP2Shell vulnerabilities?

The source describes research by Calif and Wiz Research, working separately. Calif’s account says its research involved Ryan Austin and AI assistance; Wiz says it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. PHP’s security team is credited with the fixes.

Did AI find the flaws without human researchers?

The available accounts do not support that conclusion. They describe AI tools as part of research workflows in which people selected the target, investigated the findings and worked with maintainers. Ryan Austin said, “No model is simply capable of unearthing ‘all bugs’.”

Does the 2004 advisory prove PHP2Shell went unpatched for 22 years?

No. The source says PHP fixed the specific paths reported in 2004, then connects the later discoveries to a broader concern about unsafe interruptions. It does not establish that one unchanged vulnerability remained open from 2004 to 2026.

How can PHP operators tell whether they need to update?

The supplied material does not name affected or fixed PHP versions. Operators should check PHP’s official security advisories and release notes for the applicable version information and update guidance.

Source: ThorstenMeyerAI.com