How AI-Assisted Review Helped Bring New Attention To PHP2Shell

🔍 Read the full analysis: How AI-Assisted Review Helped Bring New Attention To PHP2Shell on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on monitors, keyboards and dev gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

PHP released fixes on October 21, 2026, for two critical remote code execution vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619, known collectively as PHP2Shell. Calif and Wiz Research reported finding related flaws independently, with AI tools assisting researchers in parts of the review; the episode also drew attention to a class of PHP memory-handling concerns discussed as far back as 2004.

According to Calif’s account, researcher Ryan Austin identified multiple paths to remote code execution on August 1 and reported the first vulnerability to PHP on August 11. He shared a proof of concept on August 14, and PHP confirmed the report the following day. Calif reported a second flaw on August 21. The PHP security team made the fixes available on October 21, according to the source account.

Wiz Research worked separately, its disclosure post says. Wiz reported finding its first vulnerability on August 19, validating unauthenticated code execution against Drupal on August 20 and WordPress on August 21, then reporting it to PHP on August 24. Wiz says it used its Wiz Atlas platform alongside Gemini 4 Argon and GPT-5.6 Sol. OpenAI’s account says Calif found a critical flaw using GPT-5.6 Sol through the Patch the Planet initiative. These are organizations’ descriptions of their research, not independent evaluations of each tool’s contribution.

The vulnerabilities were described as remote code execution flaws, meaning successful exploitation could allow an attacker to run code on a vulnerable server. The source material identifies PHP as software used by a large share of the web, but does not provide a measured estimate of the number of affected installations. It also does not give enough technical detail to determine from this account which PHP configurations or versions were vulnerable. Operators should refer to PHP’s security notices and patch guidance for version-specific information.

Why PHP2Shell Matters to Operators

The reported flaws matter because PHP is widely used in web applications, and remote code execution can carry serious consequences if an exposed system is vulnerable. The PHP release puts the immediate focus on applying the vendor’s fixes, checking affected deployments and restarting services where the applicable update requires it. The source does not specify affected versions, so administrators should use PHP’s official advisory rather than infer exposure from the vulnerability names alone.

The research also offers a more grounded account of AI-assisted security review than claims that models independently discover every flaw. Calif’s description says Austin selected a familiar target, drew on its vulnerability history and formed a theory about where problems might remain. AI helped with the search, but researchers supplied direction and judgment. For software maintainers, the distinction matters: AI tools may add capacity to audits, but they do not remove the need for skilled reviewers, disclosure processes or prompt patching.

A further lesson is that old bug reports can retain investigative value. A past out-of-memory issue was initially handled as a denial-of-service concern. Calif’s account connects that history to later questions about what happens when a request is interrupted during cleanup. That connection informed the research, but it should not be taken to mean that every earlier memory-management report was evidence of exploitable code execution.

From Memory Limits to PHP2Shell

The history described by Calif begins with a July 2004 advisory by Stefan Esser, then of e-matters. The advisory warned that a remote attacker could trigger PHP’s memory-limit termination at a point where interruption was unsafe, potentially enabling code execution. PHP fixed the specific paths Esser reported. Calif’s account frames the broader risk—interruptions during partially completed operations—as a problem that proved harder to eliminate.

A later clue came in PHP bug #78876, reported in November 2019. It described large multipart form fields causing an out-of-memory condition and leaving temporary upload files behind. PHP fixed the issue in May 2020; it received CVE-2019-11048 and was treated as a denial-of-service problem because leftover files could consume disk space. Calif says the report prompted a wider question about what else might remain after an out-of-memory interruption.

In 2024, Quarkslab audited PHP with the Open Source Technology Improvement Fund and the PHP Foundation. The published results list 27 findings and four CVEs, according to the source material. Calif says the auditors encountered the same out-of-memory issue but did not establish exploitation. OSTIF’s summary, as described in the account, does not mention it. That history is a reported part of Calif’s research narrative, not proof that the 2024 audit identified the later PHP2Shell vulnerabilities.

““No model is simply capable of unearthing ‘all bugs’.””

— Ryan Austin, Calif

Details Still Missing From the Record

The source account does not identify which PHP versions are affected, list the complete technical conditions for exploitation, or provide the official advisory text and patch-level details. It also does not explain how the two CVEs map to individual attack paths, or whether the same deployments are affected by both. Those details should be checked against PHP’s own security notices.

The accounts differ in their descriptions of the tools and research process: Calif describes its work with GPT-5.6 Sol, while Wiz reports using its platform with Gemini 4 Argon and GPT-5.6 Sol. Both teams’ findings and tool descriptions are attributed to their own disclosures. The material does not provide an independent technical analysis comparing the models’ contributions, nor does it establish how much of the discovery depended on AI rather than researcher expertise.

Calif’s account also says the 2024 audit encountered an earlier out-of-memory issue without proving exploitation. The available material does not provide the underlying audit finding or evidence that links it directly to either 2026 vulnerability. That connection remains part of Calif’s explanation of the research trail, not a confirmed finding about the audit’s scope.

Patch Guidance and Disclosure Follow-Up

PHP administrators should check the official PHP security advisories for the affected branches and apply the relevant updates. Because the source material does not list affected versions or patch numbers, operators should not assume that a particular release is safe or vulnerable based only on this account. After patching, they should follow their normal service restart and verification procedures and review vendor guidance for applications built on PHP.

Further clarity depends on technical advisories from PHP and fuller disclosure details from Calif and Wiz. Those materials can establish the affected configurations, how the CVEs relate to each other and what conditions an attacker would need. Until those specifics are available in the material at hand, the confirmed development is that PHP shipped fixes and the two research groups reported related discoveries; the exact exposure for any given deployment must be determined from the vendor’s version-specific guidance.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used for two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The source material does not include the full technical advisories or map each CVE to a specific attack path.

When did PHP release fixes?

The source account says PHP shipped fixes on October 21, 2026. It does not list the affected PHP branches or the exact patched version numbers, so administrators should check PHP’s official security notices.

How did AI assist the researchers?

Calif says its work used GPT-5.6 Sol; Wiz says it used Wiz Atlas with Gemini 4 Argon and GPT-5.6 Sol. The researchers’ accounts describe AI as part of a review process guided by human researchers. The source does not independently measure each tool’s contribution.

Does the earlier memory-limit history prove the 2024 audit found PHP2Shell?

No. Calif says an out-of-memory issue was encountered during the 2024 audit but that exploitation was not proven. The available account does not establish that the audit identified either 2026 PHP2Shell vulnerability.

What should PHP administrators do now?

Check PHP’s official security advisories to determine whether a deployment is affected, then apply the relevant update and follow PHP’s operational guidance. The source material does not provide enough version detail to identify affected installations on its own.

Source: ThorstenMeyerAI.com