The Making Of PHP2Shell: A Long Story With An AI-Assisted Review

🔍 Read the full analysis: The Making Of PHP2Shell: A Long Story With An AI-Assisted Review on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP released fixes on Oct. 21, 2026, for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, called PHP2Shell. A retrospective published the following day by Thorsten Meyer traces the findings to a long-running security concern in PHP and says researchers at Calif and Wiz used AI tools as part of their work; the research also involved OpenAI, while the PHP security team made the fixes.

Meyer’s account, based on Calif’s write-up, describes the vulnerabilities as the result of research into how PHP handles memory exhaustion and interruptions during request processing. The concern is that a request stopped at an unsafe point could leave internal state or resources in a condition that might be abused. The account links that general class of risk to a warning published in 2004, but the supplied material does not include the technical advisories for the two new CVEs or enough detail to independently establish their exploit conditions.

Calif researcher Ryan Austin’s approach drew on familiarity with PHP and its vulnerability history. According to the account, he began with a theory about where bugs could remain and used generally available models without a specialized testing harness. OpenAI said Calif found a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative. Austin cautioned that AI does not find every bug automatically: “No model is simply capable of unearthing ‘all bugs.’”

Wiz Research pursued the issue separately. Its disclosure post, as summarized by Meyer, says Wiz found a PHP vulnerability on Aug. 19, 2026, and tested unauthenticated code execution against Drupal and WordPress before reporting it to PHP on Aug. 24. Wiz said it used its Wiz Atlas platform with Gemini 4 Argon and GPT-5.6 Sol. Calif’s timeline says it reported one issue on Aug. 11, shared a proof of concept on Aug. 14, received PHP’s confirmation on Aug. 15, and reported another flaw on Aug. 21. The fixes were credited to PHP’s security team.

Why PHP Runtime Bugs Matter

PHP remains widely used to run websites and web applications, so flaws in the runtime can affect many kinds of services. Remote code execution is a serious class of vulnerability because, depending on the affected configuration and exploit requirements, it may allow an attacker to run code on a server. The supplied material does not specify the exact exposure conditions for either PHP2Shell flaw, so operators should consult the official PHP advisories rather than assume every PHP installation is equally vulnerable.

The account also offers a measured example of AI-assisted security research. The researchers’ descriptions show models being used alongside human judgment, historical knowledge and testing—not as autonomous tools that reliably discover every weakness. That distinction matters as software teams evaluate claims about AI finding bugs: the model, researcher, target selection and verification all form part of the process.

From a 2004 Warning to PHP2Shell

In July 2004, security researcher Stefan Esser published an advisory about PHP’s memory limit. Meyer quotes the warning that a remote attacker could trigger request termination “in places where an interruption is unsafe.” PHP fixed the specific paths Esser reported, according to the retrospective, but the broader problem of interruption at unsafe moments remained a concern.

A later clue appeared in PHP bug tracker report #78876, submitted in November 2019. It described large multipart form fields causing memory exhaustion and leaving temporary upload files behind. PHP fixed that issue in May 2020, and it received CVE-2019-11048 as a denial-of-service vulnerability. Calif’s account says an audit in 2024 saw a related out-of-memory issue again, but exploitation was not demonstrated. Meyer notes that the audit summary itself does not mention that issue, leaving the characterization attributable to Calif rather than independently established by the summary.

In 2026, OpenAI invited Calif to participate in Patch the Planet, an effort to help open-source maintainers improve security. Calif brought the PHP Foundation into the work, according to Meyer. The resulting research coincided with Wiz’s separate investigation, and the two teams reported vulnerabilities to the PHP project during August.

““possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe””

— Stefan Esser, in his July 2004 PHP advisory, as quoted by Meyer

Exploit Conditions and Exposure

The supplied material does not give the full PHP security advisories, affected PHP versions, configuration requirements, or technical details needed to determine which deployments are exposed. It also does not establish whether the two CVEs have identical attack prerequisites or whether either was exploited in the wild. Those points should be checked against PHP’s official notices and any later vendor guidance.

Some elements of the timeline and AI’s role are based on statements by Calif, OpenAI, Wiz and Google. The account says Calif identified several independent paths to remote code execution, while Wiz describes its own discovery and validation; the available material does not provide enough technical information to compare the findings or assign a precise share of the research to each tool. The report of a related issue during the 2024 audit is also attributed to Calif, and is not reflected in the audit summary cited by Meyer.

Patch and Verify PHP Systems

PHP operators should review the project’s official advisories for CVE-2026-109618 and CVE-2026-109619, identify whether their deployed versions are affected, and apply the recommended updates. After patching, teams should follow their normal deployment checks and monitor further guidance from PHP and relevant hosting or application vendors. The source account does not state a specific deadline or provide a complete version-by-version remediation list.

Further technical disclosures may clarify the vulnerabilities’ prerequisites, the relationship between the two findings and the precise role of AI tools in each research effort. Until those details are available, the confirmed development is that PHP shipped fixes; broader claims about exposure or exploitability should remain tied to the project’s advisories and the researchers’ own disclosures.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used in the source account for two remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, for which PHP shipped fixes on Oct. 21, 2026.

Did AI find the PHP vulnerabilities on its own?

No. Calif’s account describes a researcher directing the investigation using knowledge of PHP’s history, with AI models assisting the work. Austin said no model can find all bugs, and the source does not provide an independent measure of how much each model contributed.

Did Calif and Wiz work together?

The account describes their investigations as separate and says each team reported findings to PHP in August 2026. The supplied material does not establish that the teams collaborated on discovery.

What should PHP operators do?

Check PHP’s official notices for the affected versions and recommended updates, then patch systems that are affected. The source material does not list the complete version range or configuration-specific exposure conditions.

Source: ThorstenMeyerAI.com