TL;DR
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
PHP released fixes on Oct. 21, 2026, for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Calif, OpenAI and Wiz are credited with research; Calif’s account links the discovery to an unsafe-interruption warning from 2004 and a later out-of-memory bug, though the material does not establish that the same flaw persisted unchanged for 22 years.
PHP released fixes on Oct. 21, 2026, for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, after research credited to Calif, OpenAI and Wiz. The findings drew attention to AI-assisted security review, while Calif’s account traces a related class of unsafe interruptions and out-of-memory behavior through records dating to 2004.
The PHP security advisory lists PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as releases containing fixes. Both vulnerabilities received a 9.2 severity score under CVSS 4.0. PHP published the fixes and public disclosures on the same day. The supplied material does not describe the vulnerabilities’ technical details beyond their remote code execution impact.
Calif says it joined OpenAI’s Patch the Planet initiative on July 30, 2026, and began investigating PHP. Its researchers reported one issue on Aug. 11, produced a working proof of concept on Aug. 14, and received confirmation from PHP on Aug. 15. Calif reported a second issue on Aug. 21. The source credits Calif’s research and write-up to Ryan Austin.
Wiz Research says it found its first PHP flaw between Aug. 19 and 24, and reported it on Aug. 24. According to the source material, Wiz used its Atlas system with Gemini 4 Argon and GPT-5.6 Sol, and confirmed remote code execution against Drupal and WordPress. These are attributed research claims; the supplied material does not include Wiz’s full technical report or independent validation of those tests.
Security briefing · PHP runtime · October 21, 2026
PHP2Shell After 22 Years: How AI-Assisted Review Shaped the Story
PHP published fixes for two critical remote code execution vulnerabilities. The research connects modern review to a longer history of unsafe interruption and memory handling—but the available record does not prove one flaw remained open for 22 years.
PHP’s reach raises patch stakes
PHP runs server-side code for websites and applications. A remote code execution flaw can therefore matter beyond one installation, even though the supplied reporting does not quantify exposure.
Remote code execution
The two critical vulnerabilities affect the PHP runtime. The material does not describe their technical mechanics beyond this impact.
Platform testing cited
Wiz says it confirmed RCE against Drupal and WordPress. These are attributed research claims, without independent validation in the supplied material.
Review and update
Operators of supported PHP branches should check the PHP security advisory and apply the corresponding fixed release.
From investigation to public fixes
Dates and milestones below reflect the supplied accounts from Calif and Wiz.
Calif begins
Calif says it joined OpenAI’s Patch the Planet initiative and began investigating PHP.
First issue confirmed
Reported Aug 11; working proof of concept Aug 14; PHP confirmation Aug 15.
Wiz reports a flaw
Wiz says it found its first PHP flaw in this window and reported it Aug 24. Calif reported a second issue Aug 21.
Fixes published
PHP published patched releases and public disclosures on the same day.
From memory limits to modern review
The record spans multiple reports and fixes. It supports renewed scrutiny of related behavior, not a claim that one identical flaw persisted continuously.
2004: Stefan Esser’s e-matters Advisory 11/2004 warned that a remote attacker could trigger PHP’s memory-limit termination where interruption was unsafe, potentially allowing code execution. PHP addressed the specific paths described at the time.
2019–2020: Bug report #78876 described long multipart form fields causing out-of-memory behavior and temporary files not being cleaned up. PHP fixed it in May 2020 as CVE-2019-11048, then characterized as denial of service.
2024: Calif says a Quarkslab audit with OSTIF and the PHP Foundation rediscovered the out-of-memory issue, but exploitation was not proven then. Calif says its 2026 investigation followed this history; the supplied account says OSTIF’s summary does not mention the issue.
“possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe.”Stefan Esser · e-matters Advisory 11/2004
“exploitation was not proven, hence the bug was not fixed.”Calif, as quoted in the supplied source
What the timeline cannot prove: It does not establish that the 2026 vulnerabilities were the same flaws Esser described, or that one vulnerability remained open and exploitable for 22 years. The exact technical relationship requires the PHP advisories and research reports.
Contribution is not attribution math
The accounts describe researchers and tools, but do not isolate how much AI contributed or compare the results with conventional review.
Calif’s PHP investigation
The supplied account credits Calif’s research and write-up to Ryan Austin. It describes two reported issues, a proof of concept, and confirmation from PHP for the first.
Calif connects its investigation to earlier records of unsafe interruption and out-of-memory behavior.
Tools and platform testing
Wiz says its Atlas system supported the research and that it confirmed remote code execution against Drupal and WordPress. The supplied material does not include Wiz’s full technical report or independent validation.
Check the branch. Apply the fix.
Use the PHP security advisory for branch-specific guidance, then confirm the deployed runtime is updated.
The supplied material does not say whether either vulnerability was exploited in the wild, how many deployments were exposed, or what exact conditions were required for exploitation. Further detail depends on technical disclosures from PHP and the research teams.
What the record says
What is PHP2Shell?
The supplied source uses the name for two PHP remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both received a 9.2 CVSS 4.0 score.
Which versions include fixes?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, published on October 21, 2026.
Who is credited with the research?
The source credits Calif, OpenAI and Wiz. It describes AI tools used in Wiz’s work, but does not quantify AI’s contribution to discovery.
Were the flaws open for 22 years?
The timeline connects the findings to a 2004 warning about unsafe interruption behavior. It does not prove the 2026 flaws were identical or continuously exploitable for 22 years.
Unsafe interruption warning
Out-of-memory report and fix
Rediscovery reported by Calif
Research, disclosure, patches
PHP’s Reach Raises Patch Stakes
PHP runs server-side code for websites and applications, so remote code execution flaws can have consequences beyond a single installation. The source describes testing involving Drupal and WordPress, two widely used platforms, but does not quantify affected sites or report exploitation in the wild. Administrators of supported PHP branches should review the release advisory and update to a fixed version.
The research also gives security teams a case study in how AI-assisted review can contribute to vulnerability discovery. The material credits several groups and describes tools used by Wiz, but it does not isolate how much of the discovery depended on AI, nor compare the results with conventional review. The security outcome is the confirmed release of patches; broader claims about AI’s effectiveness require more evidence.
As an affiliate, we earn on qualifying purchases.
From Memory Limits to Modern Review
In July 2004, security researcher Stefan Esser published e-matters Advisory 11/2004, warning that a remote attacker could trigger PHP’s memory-limit termination at a point where interruption was unsafe. The advisory said this could permit code execution on remote PHP servers. PHP addressed the specific paths described then; the current material presents the advisory as an early account of the broader challenge of interrupting execution safely.
A later clue appeared in PHP bug tracker report #78876, filed Nov. 28, 2019. It described long multipart form fields causing an out-of-memory condition and temporary files not being cleaned up. PHP fixed the issue in May 2020 as CVE-2019-11048, then characterized as denial of service. Calif says a 2024 audit by Quarkslab with OSTIF and the PHP Foundation rediscovered the out-of-memory issue, but exploitation was not proven at that time. OSTIF’s summary, according to the supplied source, does not mention it.
Calif’s account connects those events to its 2026 investigation. That chronology supports a history of related concerns and renewed scrutiny; it does not by itself establish that the 2004 and 2026 vulnerabilities were identical or continuously exploitable throughout the intervening years.
““possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe.””
— Stefan Esser, e-matters Advisory 11/2004
remote code execution vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What the Timeline Cannot Prove
The supplied material does not establish that the 2026 vulnerabilities are the same flaws Esser described in 2004, or that one vulnerability remained open for 22 years. It presents a connection through a broader class of interruption and memory-handling problems. The exact technical relationship requires the PHP advisories and research reports.
It is also unclear from the material whether attackers exploited either vulnerability before the patches, how many deployments were exposed, and what conditions were required for exploitation. The article’s account does not include a detailed explanation of each CVE or a breakdown of what AI systems contributed to the researchers’ work.
As an affiliate, we earn on qualifying purchases.
Patch Deployment and Further Detail
PHP users should check whether their systems run one of the fixed branches and apply the corresponding release: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Operators should consult the PHP security advisory for branch-specific guidance and confirm that their deployed runtime is updated.
Further clarity depends on technical disclosures from PHP and the research teams, including details about exploit conditions, the relationship between the two CVEs and earlier reports, and any evidence of exploitation. The supplied material does not give a schedule for additional disclosures.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used in the supplied source for two PHP remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both were rated 9.2 under CVSS 4.0.
Which PHP versions include the fixes?
The releases listed in the source are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, published on Oct. 21, 2026.
Who is credited with finding the vulnerabilities?
The source credits Calif, OpenAI and Wiz with research. It describes AI tools used in Wiz’s work, but does not quantify AI’s contribution to discovery.
Were the flaws exploited before PHP patched them?
The supplied material does not say whether either vulnerability was exploited in the wild. That remains unclear from the information available here.
Were the 2026 flaws open for 22 years?
The timeline connects the 2026 findings to a 2004 warning about unsafe interruption behavior, but it does not prove the vulnerabilities were identical or continuously exploitable for 22 years.
Source: Thorsten Meyer AI
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
