What The PHP2Shell Journey Shows About AI-Assisted Code Review

🔍 Read the full analysis: What The PHP2Shell Journey Shows About AI-Assisted Code Review on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP shipped fixes on October 21, 2026, for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. The discoveries involved separate investigations by Calif and Wiz Research, both of which used AI tools; the account of the work traces the underlying vulnerability class to a 2004 warning about PHP requests being interrupted unsafely.

According to Calif’s account, its researcher Ryan Austin found several independent paths to remote code execution on August 1, 2026. Calif published a hash of one finding on August 5 as a way to document possession without revealing the details, reported its first bug to PHP on August 11, and sent a working proof of concept on August 14. PHP confirmed it the next day, and Calif reported a second bug on August 21.

Wiz Research worked separately. Its disclosure says it found its first PHP vulnerability on August 19, using Wiz Atlas alongside Gemini 4 Argon and GPT-5.6 Sol. Wiz says it validated unauthenticated code execution against Drupal on August 20 and WordPress on August 21, then reported the issue to PHP on August 24. PHP’s security team made the fixes; the supplied account identifies the two CVEs but does not provide a detailed technical description of each patch.

The research credit is shared among Calif, OpenAI and Wiz, according to the source account. OpenAI said Calif used GPT-5.6 Sol through its Patch the Planet initiative. Wiz and Google’s security blog credited Gemini 4 Argon with contributions to finding the vulnerability, exploit development, attack detection and patch validation. Those descriptions are attributed accounts of the tools’ role, not evidence that the models independently discovered or verified the flaws.

Why PHP2Shell Reached Remote Execution

The episode matters because PHP is widely used to run web applications, and remote code execution can allow an attacker to run code on a vulnerable server. The exact exposure depends on the affected PHP versions, deployment and whether a site has applied the fixes; the source material does not give a count of affected systems or confirmed exploitation in the wild.

For security teams, the research also offers a grounded account of AI-assisted review. The models were used within investigations directed by researchers who knew PHP’s history and had a theory about where to look. That distinction matters: AI helped with a search, but the account does not support a claim that a model autonomously audited PHP or can find every bug. Maintainers still need careful review, disclosure coordination and timely patching.

The history also highlights a challenge in interpreting security audits. Calif says a related out-of-memory issue surfaced in a 2024 audit but exploitation was not proven then. An unproven impact does not establish that a code path is safe, though the available material does not independently document that audit claim.

From a 2004 Warning to PHP2Shell

In July 2004, security researcher Stefan Esser published an advisory warning that a remote attacker could trigger PHP’s memory-limit termination while the runtime was in a state where interruption was unsafe. The advisory, identified as CAN-2004-0594, said this could be abused to execute code remotely. PHP fixed the specific paths Esser reported, but the broader risk of interruption during unfinished operations remained a concern.

A later clue appeared in PHP bug report #78876, filed on November 28, 2019. It described large multipart form fields causing an out-of-memory failure and leaving temporary upload files behind. PHP fixed the issue in May 2020; it received CVE-2019-11048 and was treated as a denial-of-service problem because leftover files could consume disk space.

Calif’s account says auditors encountered the same out-of-memory issue during a 2024 PHP audit, but could not prove exploitation. The audit’s published results, as described in the supplied material, list 27 findings and four CVEs; its OSTIF summary does not mention an out-of-memory issue. Calif’s account then connects this older research history with the 2026 investigations, where researchers used AI tools to help examine a familiar class of risk.

““possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe””

— Stefan Esser, in the 2004 PHP security advisory

What the Disclosures Leave Open

The supplied material does not detail the precise code paths for CVE-2026-109618 and CVE-2026-109619, the PHP versions affected, or whether the flaws were exploited before the fixes. It also does not provide a complete account of the patch changes or state how many servers remain unpatched.

The research timelines and descriptions of AI contributions come from Calif, Wiz, OpenAI and Google communications. The material supports that both research efforts used AI tools, but it does not establish a controlled comparison of AI performance against conventional review, or quantify how much the models contributed. Calif’s claim that the 2024 audit encountered the issue is also not reflected in the OSTIF summary described in the source, leaving that point unresolved.

Patch Deployment and Disclosure Details

PHP has released fixes, so operators should check the project’s security advisories and upgrade to a patched release appropriate for their installations. The supplied source points readers to a separate patch-and-restart guide, but does not specify affected version ranges or provide a deadline for upgrading.

Further clarity depends on PHP’s technical advisories and any fuller disclosures from Calif and Wiz. Those materials could establish which versions and configurations are vulnerable, explain how the two CVEs relate, and report whether investigators or maintainers have evidence of exploitation. Until then, the confirmed development is that PHP issued fixes after coordinated research—not that all deployments are patched or that AI alone found the flaws.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, for which PHP shipped fixes on October 21, 2026.

Who found the vulnerabilities?

The supplied account credits research by Calif and Wiz Research, working independently. Calif reported two bugs, while Wiz says it found a vulnerability and tested unauthenticated code execution against Drupal and WordPress.

Did AI discover PHP2Shell on its own?

No such conclusion is supported by the material. Calif and Wiz say they used AI tools during research, but the work was directed by researchers; Calif researcher Ryan Austin said no model can find all bugs.

What should PHP operators do?

Operators should consult PHP’s security advisories and install the applicable fixes. The supplied source does not specify the affected version ranges, so administrators should verify the correct upgrade path for their deployment.

Is there evidence the flaws were exploited?

The supplied material does not say whether either flaw was exploited before PHP released the fixes. That remains unclear from the available account.

Source: ThorstenMeyerAI.com