How AI-Assisted Review Reframed The PHP2Shell Story

🔍 Read the full analysis: How AI-Assisted Review Reframed The PHP2Shell Story on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP shipped fixes on October 21, 2026, for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. Calif and Wiz Research reported related vulnerabilities after separate AI-assisted reviews, bringing renewed attention to a memory-limit safety concern first documented in a 2004 advisory.

According to the account published by ThorstenMeyerAI.com on October 22, Calif traced the issue through PHP’s history of out-of-memory behavior. The account says the relevant failure mode can arise when a request is interrupted while PHP is partway through setting up data structures, leaving incomplete state for cleanup code. Such interruptions, it argues, can create security consequences beyond an ordinary crash.

Calif’s timeline says researchers found several independent paths to remote code execution on August 1, 2026. Ryan Austin reported one finding to PHP on August 11, provided a proof of concept on August 14, and received confirmation on August 15; he reported a second bug on August 21. Separately, Wiz Research says it found a PHP vulnerability on August 19, validated unauthenticated code execution against Drupal and WordPress on August 20 and 21, and reported the issue to PHP on August 24.

The source describes the discoveries as related, but the supplied account does not provide the PHP advisories’ technical details or map each CVE to a specific researcher’s finding. It credits Calif, OpenAI and Wiz with research and the PHP security team with the fixes. OpenAI and Wiz have described AI tools as contributors; those statements do not establish that a model found or verified the flaws without researcher direction.

AI Helped Revisit PHP’s Old Risk

The story matters because it shows how AI-assisted code review may support security research without replacing the expertise needed to guide it. Calif’s account presents Austin as starting with a known target and a theory informed by PHP’s vulnerability history. The researcher chose where to look; models helped with the search and analysis. This is a more limited claim than saying AI independently discovered the flaws.

The history also illustrates why a bug report that initially appears to involve denial of service can merit further scrutiny. A 2019 PHP report concerned oversized form fields, out-of-memory errors and temporary files left behind. PHP fixed that issue in 2020 as CVE-2019-11048, described at the time as a denial-of-service problem. Calif’s later account treats the residue as a clue about what other state might survive an interrupted request—not proof that the earlier report was itself remote code execution.

For maintainers and organizations running PHP-based services, the immediate consequence is practical: apply the PHP security fixes and follow the project’s deployment guidance. The reports also underline the value of looking again at old findings, particularly when an earlier investigation did not establish exploitability.

From a 2004 Warning to 2026

In July 2004, Stefan Esser of e-matters published Bugtraq Advisory 11/2004, titled “PHP memory_limit remote vulnerability,” associated with CAN-2004-0594. The advisory warned that a remote attacker could trigger memory-limit termination at a point where interruption was unsafe, with potential to run code on remote PHP servers. PHP fixed the specific paths described then, according to the source; the broader challenge of interruption during sensitive operations remained.

In November 2019, PHP bug #78876 reported that long multipart form fields could cause out-of-memory errors and leave temporary files behind. PHP fixed it in May 2020, and it received CVE-2019-11048. Calif says a 2024 audit rediscovered the out-of-memory issue but did not prove exploitation. The publicly described Quarkslab audit, conducted with OSTIF and the PHP Foundation, listed 27 findings and four CVEs, all resolved; OSTIF’s summary does not mention an out-of-memory finding. The distinction between those public audit details and Calif’s account should be kept clear.

In 2026, OpenAI invited Calif to participate in Patch the Planet, an initiative focused on hardening open-source software. Calif’s account says Austin used generally available models and no special harness. Wiz’s disclosure describes a separate review using its Wiz Atlas platform alongside Gemini 4 Argon and GPT-5.6 Sol. The source attributes model contributions to the companies’ statements, rather than offering an independent comparison of the tools.

Exploit Scope Still Needs Detail

The supplied material does not include the PHP security advisories, affected version ranges, patch identifiers or a technical explanation of how CVE-2026-109618 and CVE-2026-109619 relate to the researchers’ separate findings. It also does not establish how many systems were exposed or whether attackers exploited either flaw before the fixes were released. The account’s claims about the 2024 audit are attributed to Calif and differ from what appears in OSTIF’s summary. Those gaps make it difficult to assess the full scope from this material alone.

Patch Details and Disclosure Follow-Up

PHP operators should consult the project’s security notices for affected versions and install the applicable fixes, then check their deployments against official guidance. The source says fixes shipped on October 21, but does not list version numbers or patch commands. Further detail from PHP, Calif and Wiz could clarify how the two CVEs map to the reported findings, what conditions are required for exploitation and whether any exploitation has been observed. Until those details are available, AI’s role is best described as assistance within researcher-led reviews.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used in the source for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, for which PHP shipped fixes on October 21, 2026.

Which researchers reported the flaws?

The source credits Calif and Wiz Research with separate, related findings. It gives timelines for both teams but does not specify which CVE corresponds to each reported finding.

Did AI discover PHP2Shell on its own?

The available accounts describe AI as assisting researcher-led reviews. Calif’s Ryan Austin selected the target and research direction, while Wiz described using its platform with Gemini and OpenAI models. The material does not support a claim that AI found the flaws independently.

What should PHP administrators do?

Administrators should check PHP’s official security notices for affected releases and apply the relevant fixes. The supplied source does not state affected version numbers or provide patch commands.

Is there evidence the vulnerabilities were exploited in the wild?

The supplied material does not say whether attackers exploited either flaw before PHP released fixes. That point remains unconfirmed here.

Source: ThorstenMeyerAI.com