How Researchers Used AI-Assisted Review To Revisit PHP2Shell

🔍 Read the full analysis: How Researchers Used AI-Assisted Review To Revisit PHP2Shell on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get hardware and tech essentials delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP released fixes on October 21, 2026, for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, now known as PHP2Shell. The vulnerabilities were found through separate investigations by Calif and Wiz Research, which used AI-assisted review alongside human security research; the episode also revived questions about PHP memory-handling problems reported years earlier.

Calif’s account traces the investigation to a class of failure in which PHP runs out of memory while handling a request. If interruption occurs while the runtime is partway through an operation, unfinished state may remain for cleanup code. Calif’s Ryan Austin used the older vulnerability history to guide a review of where similar weaknesses might persist. The account says the research used no special testing harness and no models beyond those generally available at the time.

Calif says it found several independent paths to remote code execution on August 1, 2026. Austin published a hash of one finding on August 5, a way to establish that he had documented it without disclosing the vulnerability itself. Calif reports that it notified PHP on August 11, supplied a working proof of concept on August 14, received confirmation on August 15, and reported a second flaw on August 21.

Wiz Research was investigating separately. Its disclosure says it found its first PHP vulnerability on August 19, then validated unauthenticated code execution against Drupal on August 20 and WordPress on August 21, before reporting the issue to PHP on August 24. The source material identifies the October 21 release as the date PHP shipped fixes for both flaws. It does not provide further technical detail about the patches or identify specific affected PHP versions.

Why PHP2Shell Affects Web Operators

Remote code execution can allow an attacker to run commands on a vulnerable server, making these flaws a serious concern for organizations running PHP applications. PHP is used across a large portion of the web, and the reported checks against Drupal and WordPress show why weaknesses in the runtime can matter beyond one application. The available account does not establish that those checks were attacks against deployed systems or that the vulnerabilities were exploited in the wild.

The research also offers a more specific lesson about AI-assisted security work: models contributed to investigations, but researchers supplied the direction. Austin’s account emphasizes familiarity with PHP’s history and the decision to revisit an older class of memory-related problems. That approach is different from claiming a model can independently find every flaw. For maintainers, the immediate practical issue is to identify whether their PHP deployments are affected and apply the relevant fixes using PHP’s release guidance.

From a 2004 Warning to PHP2Shell

The history described by Calif begins with a July 2004 advisory from Stefan Esser of e-matters. Advisory 11/2004 warned that a remote attacker could trigger PHP’s memory-limit termination at a point where interruption was unsafe. PHP fixed the specific paths reported then, but Calif frames the broader problem—what happens when execution stops at the wrong moment—as a question that remained relevant.

A later clue appeared in PHP bug tracker report #78876, filed on November 28, 2019. It described oversized multipart form data causing an out-of-memory failure and leaving temporary upload files behind. PHP fixed the issue in May 2020; it received the identifier CVE-2019-11048 and was treated as a denial-of-service problem because leftover files could consume disk space. Calif says the episode prompted researchers to ask whether an out-of-memory condition might leave other unsafe state behind.

Calif also says a 2024 audit rediscovered the out-of-memory issue but did not prove exploitation. The public audit summary from OSTIF, as described in the source material, does not mention that issue, so this part of the account is attributed to Calif rather than independently confirmed by that summary. The distinction between a reported concern and a demonstrated exploit is central to the later review.

“Possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe.”

— Stefan Esser, in PHP Advisory 11/2004

What the Disclosures Do Not Establish

The supplied accounts do not say whether either PHP2Shell vulnerability was exploited in real-world attacks, how many servers were exposed, or which PHP versions and configurations were affected. They also do not provide enough technical detail to compare the two flaws or explain precisely how the fixes alter PHP’s behavior. Those questions require release notes and technical advisories from PHP and the researchers.

The account of the 2024 audit finding is attributed to Calif and is not reflected in the cited OSTIF summary. That does not resolve whether the finding was present in the audit’s full record, how it was assessed, or what evidence was available at the time. Claims about AI’s role also come from the participating research organizations; the material does not provide an independent comparison of how much work the models performed versus the researchers.

Patch Guidance and Further Disclosure

PHP has shipped fixes, so operators should consult the project’s security advisories and release guidance to determine whether their versions require updating. The source material gives October 21, 2026, as the patch date but does not include version numbers or a step-by-step mitigation procedure. Administrators should verify their deployments against PHP’s published notices rather than assume that every installation is affected—or that a particular installation is safe.

Further technical reporting from PHP, Calif, and Wiz may clarify affected versions, the mechanics of each flaw, and whether there is evidence of exploitation. Until such details are available, the confirmed development is the release of fixes following two separate research efforts, not a confirmed campaign against PHP-based sites.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used for two critical remote code execution flaws in PHP: CVE-2026-109618 and CVE-2026-109619. PHP shipped fixes for them on October 21, 2026.

Who found the vulnerabilities?

Calif and Wiz Research investigated PHP separately and reported vulnerabilities to the PHP project. Their accounts describe AI-assisted methods as part of the work, alongside human research and validation.

Were the flaws exploited in the wild?

The supplied source material does not confirm real-world exploitation. Wiz’s reported checks against Drupal and WordPress demonstrate validation in those applications, but do not establish attacks against deployed services.

What should PHP operators do?

Operators should check PHP’s official security notices and release guidance, then apply the relevant fix if their version is affected. The source material does not list affected versions, so administrators should verify that information with PHP’s advisories.

Did AI discover PHP2Shell on its own?

No. The accounts describe AI tools as contributing to research, while researchers selected the target, brought historical knowledge to the review, and tested findings. Calif researcher Ryan Austin said, “No model is simply capable of unearthing ‘all bugs.’”

Source: ThorstenMeyerAI.com