A 22-Year PHP Security Story Meets AI-Assisted Review

🔍 Read the full analysis: A 22-Year PHP Security Story Meets AI-Assisted Review on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP released fixes on October 21, 2026 for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell. The findings came from separate research by Calif and Wiz, both of which used AI tools as part of their work; the cases also revive a security concern first described in a PHP advisory in 2004.

According to Calif’s published timeline, its researchers found several paths to remote code execution on August 1, 2026, reported one flaw to PHP on August 11, and supplied a working proof of concept on August 14. PHP confirmed the issue the next day. Calif reported a second bug on August 21. The account says the PHP security team made the fixes; the supplied material does not identify the affected PHP versions or provide patch numbers.

Wiz Research was investigating PHP independently. Its disclosure says it found a vulnerability on August 19 using its Wiz Atlas platform with Gemini 4 Argon and GPT-5.6 Sol. Wiz said it confirmed unauthenticated code execution against Drupal on August 20 and WordPress on August 21, then reported the issue to PHP on August 24. Those application tests are attributed to Wiz; the source material does not establish that every Drupal or WordPress installation is affected.

The research accounts describe AI as an aid, not an autonomous discovery process. Calif researcher Ryan Austin chose the target and directed the search using knowledge of PHP’s vulnerability history. Calif’s write-up says the work used no special harness and no models beyond those generally available. OpenAI credited its model with contributing to Calif’s work, while Wiz and Google’s security blog credited Gemini with contributions across finding, exploit development, detection and patch validation.

Why Old PHP Bugs Still Matter

The episode matters because PHP runs a large share of the web, so flaws in its runtime can have consequences beyond a single application. Wiz’s reported tests against Drupal and WordPress illustrate how a runtime weakness may affect software built on top of it, although the extent of exposure depends on details not supplied here. Operators should use PHP’s official advisories and release notes to identify affected versions and apply the relevant fixes.

It also offers a more specific account of AI-assisted security research than the claim that models simply find vulnerabilities on their own. Calif’s approach paired a researcher’s historical knowledge with model-assisted exploration. That division of work is relevant to defenders evaluating AI security tools: the tools may speed parts of an investigation, but the source material does not show that they replace expert judgment or reliably find every bug.

From Memory Limits to PHP2Shell

The historical thread begins with a July 2004 advisory by Stefan Esser of e-matters, posted to the Bugtraq mailing list as Advisory 11/2004 and associated with CAN-2004-0594. Esser warned that an attacker could trigger PHP’s memory-limit termination at a point where interrupting execution was unsafe, potentially enabling code execution. PHP fixed the specific paths he identified, but the broader problem of stopping execution during unfinished operations remained a concern.

A later report offered a possible clue. PHP bug #78876, filed on November 28, 2019, described oversized multipart form fields causing an out-of-memory failure and leaving temporary files behind. PHP addressed the issue in May 2020; it received CVE-2019-11048 and was treated as a denial-of-service vulnerability because leftover files could consume disk space.

Calif says a 2024 audit by Quarkslab, conducted with OSTIF and the PHP Foundation, encountered the same out-of-memory issue, but did not establish exploitability. OSTIF’s public summary lists 27 findings and four CVEs, all resolved, and does not mention an out-of-memory issue. The audit account and the later research history are separate: the supplied material does not establish that the 2024 observation directly led to either 2026 flaw.

““possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe””

— Stefan Esser, in a July 2004 PHP security advisory

Affected Versions and Exposure

The supplied account does not list affected PHP branches, fixed release numbers, or technical indicators that administrators can use to check systems. It also does not provide the underlying advisories or enough detail to establish whether the two CVEs represent distinct exploit paths, how they relate to one another technically, or what configurations are required for exploitation.

Claims about the 2024 audit are also not fully reconciled: Calif says auditors saw the out-of-memory issue, while OSTIF’s summary does not include it. Calif reports that exploitability was not proven at that time, but the supplied material does not independently document the audit finding. The precise contribution of each AI model is based on statements from the research teams and their partners.

Patch Guidance and Disclosure Details

PHP administrators should consult official PHP security advisories and release notes for the fixed versions, then update affected installations according to their deployment procedures. The source material says fixes shipped October 21 but does not give version-specific instructions, so it cannot support a more precise upgrade recommendation here.

Further information to watch for includes PHP’s technical advisories, fuller disclosure details from Calif and Wiz, and clarification about affected versions and application exposure. Until those details are available, the confirmed development is that PHP has shipped fixes for two critical remote code execution flaws—not that every system using PHP, Drupal or WordPress is vulnerable.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, for which PHP shipped fixes on October 21, 2026.

Who found the vulnerabilities?

Calif and Wiz Research reported findings through separate investigations. Their accounts describe using AI tools alongside researcher-led analysis.

Did AI discover the flaws by itself?

The source material does not support that conclusion. Calif researcher Ryan Austin selected the target and guided the search using knowledge of PHP’s history; the research teams describe AI as contributing to parts of their work.

Which PHP versions need an update?

The supplied material does not identify affected branches or fixed release numbers. Administrators should check PHP’s official advisories and release notes for version-specific guidance.

Does the report mean all Drupal and WordPress sites are vulnerable?

No. Wiz said it confirmed code execution against Drupal and WordPress in its testing, but the available account does not establish that every installation is affected or specify the conditions required.

Source: ThorstenMeyerAI.com