How AI-Assisted Review Helped Finish A Chapter In PHP2Shell’s History

🔍 Read the full analysis: How AI-Assisted Review Helped Finish A Chapter In PHP2Shell’s History on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP shipped fixes on October 21, 2026, for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. The research involved Calif and Wiz Research working separately, with AI tools assisting their investigations; the findings matter because PHP runs a substantial share of the web, though the supplied account does not specify affected versions or how many systems were exposed.

According to the source account, Calif identified several independent paths to remote code execution on August 1, 2026. Researcher Ryan Austin reported one flaw to PHP on August 11, supplied a working proof of concept on August 14, and received confirmation from PHP on August 15. He reported a second issue on August 21. Calif had published a hash of one finding on August 5, a way to establish later that it possessed the finding without disclosing its details at the time.

Wiz Research worked independently and found its first PHP vulnerability on August 19, according to its disclosure post. The team reported confirming unauthenticated code execution against Drupal on August 20 and WordPress on August 21, then notified PHP on August 24. The source says OpenAI and Google described AI models as contributing to the research, but the account does not provide a complete technical description of either vulnerability or map each CVE to a particular finding.

The fixes were made by the PHP security team, according to the source. The reporting credits Calif, OpenAI and Wiz with the research, and identifies Austin as the author of Calif’s research and write-up. It describes the episode as AI-assisted review, not autonomous discovery: researchers chose the target, brought knowledge of PHP’s history and directed the investigation.

Why PHP’s Old Bug History Matters

The episode illustrates how a vulnerability can be missed when reviewers see an old failure as an isolated reliability issue. In 2004, a security advisory warned that PHP’s memory-limit termination could occur at a point where interruption was unsafe. The underlying concern was that stopping execution during incomplete setup could leave inconsistent state for cleanup code to handle.

That history matters because AI-assisted review did not replace researcher judgment in the account. Calif researcher Ryan Austin chose a target he knew and pursued a theory grounded in PHP’s past vulnerabilities. The source says he used no special harness and no models beyond those generally available. AI tools were part of the search, but the account credits human expertise with directing attention toward an older class of risk.

For maintainers and operators, the immediate significance is the release of fixes for two critical remote code execution flaws. Remote code execution can allow an attacker to run code on a vulnerable server, making timely patching important for organizations that use affected PHP releases. The supplied material does not identify those releases, so administrators should consult PHP’s official security advisories and their distribution’s notices before deciding whether a specific installation is affected.

From Memory Limits to PHP2Shell

The history described in the source begins with a July 2004 advisory by Stefan Esser of e-matters, published to the Bugtraq mailing list as Advisory 11/2004, “PHP memory_limit remote vulnerability.” It said a remote attacker could trigger memory-limit termination where interruption was unsafe and described the possibility of executing code on remote PHP servers. PHP fixed the specific paths reported then, but the broader problem of interruption at an unsafe moment remained a concern.

A later clue appeared in PHP bug #78876, filed on November 28, 2019. It described oversized multipart form data causing an out-of-memory failure and leaving temporary files behind. PHP fixed that issue in May 2020; it was tracked as CVE-2019-11048 and treated as a denial-of-service risk because leftover files could fill disk storage.

Calif’s account says a 2024 audit by Quarkslab, with OSTIF and the PHP Foundation, encountered the same out-of-memory issue, but exploitation was not proven. OSTIF’s published summary lists 27 findings and four CVEs, all resolved, and does not mention that issue. The account’s description of what auditors saw should therefore be treated as Calif’s attribution, not as a detail independently confirmed by the cited summary.

“It was “possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe.””

— Stefan Esser, in a 2004 PHP security advisory

Affected PHP Releases Still Unspecified

The supplied material does not identify which PHP versions are affected, which versions contain the fixes, or whether the vulnerabilities were exploited in real-world attacks. It also does not provide enough technical detail to establish how the two CVEs relate to the separate findings reported by Calif and Wiz.

Some parts of the history are specifically attributed to Calif rather than confirmed by the audit material cited in the account. In particular, OSTIF’s summary does not mention the alleged rediscovery of the out-of-memory issue. The source also does not include PHP’s advisory text or a direct statement from the PHP security team, limiting independent verification of the patch details here.

Check PHP’s Advisories for Patch Details

PHP operators should check the official PHP security advisories for the affected release branches and update guidance, then review notices from their operating-system or hosting provider. The supplied source says fixes shipped October 21, but does not name patched versions or outline restart and verification steps; those details should come from the maintainers’ published instructions.

The next public milestone is fuller technical disclosure from the researchers and PHP maintainers, including precise version ranges and vulnerability details. Until those details are available, claims about exposure, exploitation and the contribution of individual AI models should remain bounded by what the source and official advisories establish.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, for which PHP shipped fixes on October 21, 2026.

Who found the vulnerabilities?

The account credits Calif and Wiz Research with separate research efforts. Calif reported findings to PHP in August, while Wiz says it independently found and reported a vulnerability later that month.

What role did AI play?

AI models assisted the researchers’ review, according to the source and the research organizations’ statements. The account says researchers selected targets and directed the work; it does not establish that a model found the flaws without human guidance.

Which PHP versions need an update?

The supplied material does not list affected or fixed versions. Administrators should check PHP’s official advisory and their software distributor’s security notice for version-specific instructions.

Is there evidence the flaws were exploited?

The source material does not report confirmed real-world exploitation. That absence in the supplied account does not establish that exploitation did not occur; the status is not specified.

Source: ThorstenMeyerAI.com