How AI Helped Researchers Reexamine A 22-Year PHP2Shell Trail

🔍 Read the full analysis: How AI Helped Researchers Reexamine A 22-Year PHP2Shell Trail on ThorstenMeyerAI.com

Age 18–24?Offer from Amazon

Prime made for students and young adults

• Fast, free delivery for dorm and study essentials
• Prime Video and Amazon Music included
• Member-only deals

Try Prime for Young Adults →Free trial for eligible 18–24 year olds

As an affiliate, we earn on qualifying purchases.Hide

PHP shipped fixes on October 21, 2026, for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. The findings came from separate research by Calif and Wiz, with AI tools assisting parts of the work, and revived attention to a memory-limit security problem first publicly described in 2004.

The flaws affect PHP, a programming language used to run server-side code across websites and applications. The source account describes the vulnerabilities as allowing remote code execution, a serious class of issue because it can let an attacker run code on a vulnerable server. PHP’s security team prepared the fixes; the supplied material does not specify affected release branches or patch version numbers.

Calif’s researcher, Ryan Austin, said the work began with knowledge of PHP’s vulnerability history and a theory about where weaknesses might remain. Calif’s account says it found several paths to remote code execution on August 1, reported one issue to PHP on August 11, provided a proof of concept on August 14 and received confirmation the following day. It reported a second issue on August 21.

Wiz Research worked separately, according to its disclosure timeline. Wiz says it found a PHP vulnerability on August 19, validated unauthenticated code execution against Drupal and WordPress on August 20 and 21, respectively, and reported the issue to PHP on August 24. The accounts describe parallel findings in the same broad flaw class; the source material does not fully lay out how each research team’s findings map to the two CVE identifiers.

Why PHP’s Old Memory Bug Matters

The episode shows how a software flaw can remain relevant across decades even as individual instances are patched. The underlying concern is that an out-of-memory stop may interrupt PHP while it is partway through an operation. If cleanup then runs on an incomplete state, an event expected to end a request safely may create a security weakness. Memory-limit handling is meant to contain resource use, but its behavior at interruption points can affect server security.

For organizations running PHP applications, the immediate consequence is practical: they should identify whether their PHP deployments are covered by the October 21 fixes and apply the relevant updates. The source material does not give version-specific instructions, so administrators should consult PHP’s official release and security notices rather than infer affected versions from the research narrative.

The research also offers a grounded account of AI’s role in security work. The tools assisted researchers, but the supplied material credits human expertise in selecting the target and tracing historical clues. Calif’s Austin cautioned that no model can simply find every bug. The takeaway is not that AI independently solved a 22-year-old problem, but that it may help researchers investigate when guided by knowledge of a system’s history.

From 2004 Advisory to PHP2Shell

In July 2004, security researcher Stefan Esser published an advisory about PHP’s memory_limit behavior. The advisory said a remote attacker could trigger request termination at a point where interruption was unsafe and that the condition could be abused to run code on remote PHP servers. PHP fixed the specific paths described at the time, according to the source account; it says the broader difficulty of interruptions occurring at unsafe moments persisted.

A later clue appeared in PHP bug tracker report #78876, filed on November 28, 2019. It described large multipart form fields causing an out-of-memory condition and leaving temporary files behind. PHP fixed that issue in May 2020, and it received the identifier CVE-2019-11048. At the time, the reported impact was denial of service through disk space being consumed by leftover files.

The source account says Calif linked that report to the question of what else might remain after an out-of-memory event. It also says a 2024 PHP audit by Quarkslab, with OSTIF and the PHP Foundation, recorded 27 findings and four CVEs, all resolved. Calif says auditors encountered the same out-of-memory issue but did not prove exploitation. OSTIF’s published summary, as described in the account, does not mention that issue, so the audit connection rests on Calif’s characterization.

Open Questions About Scope and Links

The supplied material does not identify the PHP versions or release branches affected, list the exact patched versions, or explain whether the two CVEs correspond one-to-one with the findings from Calif and Wiz. It also does not provide enough technical detail to independently assess the vulnerabilities’ exploit conditions or the claims of code execution against Drupal and WordPress.

The historical relationship needs careful qualification. The source presents the 2004 advisory, the 2019 out-of-memory report and the later findings as a connected trail, but that does not by itself establish that every earlier issue was the same vulnerability or remained exploitable. Similarly, Calif’s account of the 2024 audit finding is not corroborated by the OSTIF summary cited in the source. The full technical disclosures and PHP’s advisory would be needed to resolve these points.

The source also attributes AI contributions to named models and tools, but gives no controlled comparison measuring how much faster the researchers worked or how much of each discovery was produced by a model. The confirmed news is that researchers used AI-assisted methods and PHP released fixes; the precise division of labor and broader performance claims remain less clear.

Patch Status and Disclosure Details

PHP users should check the official security notices and release information for the fixed versions that apply to their installations, then update affected systems. Organizations should also confirm that deployed applications use the updated PHP runtime; updating an application framework alone may not address a vulnerability in the language runtime.

Further clarity depends on PHP’s technical advisories and the research teams’ full disclosures, including affected versions, the relationship between the two CVEs and the findings from each team, and the conditions required for exploitation. Until those details are available in the cited material, readers should treat the 22-year timeline as the researchers’ account of how they approached the problem, not as proof that one unchanged vulnerability persisted throughout that period.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, for which PHP shipped fixes on October 21, 2026.

Did AI discover the PHP vulnerabilities by itself?

No. The source describes AI tools as assisting research by Calif and Wiz. Calif researcher Ryan Austin said the work relied on a researcher’s knowledge of PHP’s history and warned that no model can find all bugs on its own.

What does the 2004 advisory have to do with the new flaws?

The 2004 advisory warned that triggering PHP’s memory limit at an unsafe point could create a security problem. The later research revisited that broader class of interruption-related risks, but the supplied material does not establish that the 2004 issue and the 2026 CVEs are the same vulnerability.

Who found the vulnerabilities?

Calif and Wiz Research conducted separate research and reported findings to PHP in August 2026, according to their timelines as summarized in the source. The material does not fully map each team’s findings to the two CVE identifiers.

What should PHP operators do now?

Check PHP’s official security and release notices for the applicable fixed versions, update affected runtimes, and verify that deployed systems are using the patched versions. The supplied source does not provide a version-by-version patch list.

Source: ThorstenMeyerAI.com