How AI-Assisted Code Review Helped Uncover The PHP2Shell Story

Read the full analysis: How AI-Assisted Code Review Helped Uncover The PHP2Shell Story on ThorstenMeyerAI.com

PHP released fixes on October 21, 2026, for two critical remote code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which have become known as PHP2Shell. The discovery effort involved Calif and Wiz Research, whose teams used AI tools as part of investigations into PHP’s handling of out-of-memory conditions—a bug class with roots in a 2004 security warning.

The account published by Thorsten Meyer says Calif identified several potential paths to remote code execution on August 1, 2026. Researcher Ryan Austin later reported two bugs to PHP: the first on August 11, followed by a working proof of concept on August 14; PHP confirmed it on August 15. Austin reported a second bug on August 21. The source says the PHP security team made the fixes, which shipped October 21, but does not provide the release numbers or a detailed technical description of each patch.

Wiz Research worked independently and reported finding its first PHP vulnerability on August 19. In its disclosure, Wiz said it validated unauthenticated code execution against Drupal on August 20 and WordPress on August 21, then notified PHP on August 24. The account says Wiz used its Wiz Atlas platform with Gemini 4 Argon and GPT-5.6 Sol. These details are attributed to the research teams; the supplied material does not include a separate PHP statement confirming the teams’ testing results.

The source describes AI as an aid to a researcher-led process, not an autonomous discovery. Austin selected PHP based on his familiarity with its vulnerability history and pursued a theory about where weaknesses might remain. He said the work used no special harness and no models beyond those generally available. The account attributes to OpenAI the claim that Calif found a critical flaw using GPT-5.6 Sol as part of its Patch the Planet initiative. It does not establish that an AI model alone found or verified the vulnerabilities.

Why PHP’s Old Bug Class Matters

PHP runs a large amount of web infrastructure, and remote code execution can allow an attacker to run code on a vulnerable server. The teams’ reported validation against widely used content-management systems makes the disclosure relevant to organizations that operate PHP-based sites, although the supplied material does not specify affected versions, exposure conditions or the number of vulnerable installations.

The research also illustrates a practical limit of AI-assisted security work. A model may accelerate code review or help explore a researcher’s hypothesis, but it does not replace the judgment needed to connect a current failure mode with older advisories and bug reports. Austin’s conclusion, as quoted in the source, was that “No model is simply capable of unearthing ‘all bugs’.” For defenders, the immediate priority is to follow PHP’s security guidance and apply the relevant fixes; the broader lesson is that old, unresolved questions can remain useful leads in modern audits.

From the 2004 Warning to PHP2Shell

The history in Meyer’s account begins with a July 2004 advisory by Stefan Esser, then of e-matters. The advisory warned that an attacker could trigger PHP’s memory-limit termination at a point where interrupting execution was unsafe, potentially enabling code execution. PHP fixed the specific paths Esser reported, but the account says the wider problem of interruption during partially completed operations remained difficult.

A later clue appeared in PHP bug tracker report #78876, filed in November 2019. It described oversized multipart form fields causing an out-of-memory failure and leaving temporary upload files behind. PHP fixed that issue in May 2020, and it received CVE-2019-11048 as a denial-of-service vulnerability. Calif’s interpretation was that the leftover files suggested a broader question about what state might persist after memory exhaustion. That interpretation should be distinguished from the original tracker report and its documented impact.

The source also says Calif believed a 2024 audit had encountered the out-of-memory issue again, but that exploitation was not proven. It notes that the public audit summary does not mention such a finding. The account then places the 2026 research within OpenAI’s Patch the Planet initiative, which invited Calif to help harden open-source software, with PHP selected as a high-impact target.

Details Still Missing from the Record

The supplied material does not identify the PHP versions affected, the exact conditions required to exploit either vulnerability, or whether the two CVEs represent distinct code paths with different exposure. It also does not include the PHP security team’s advisory text, so patch coverage and any recommended workarounds cannot be independently described here.

The researchers’ reported testing against Drupal and WordPress is not enough on its own to establish that every installation of those platforms was vulnerable. The account gives no evidence of attacks in the wild, confirmed compromises, or the number of affected servers. It also presents Calif’s description of the 2024 audit finding, while acknowledging that the public audit summary does not mention it and that exploitation was not proven. The precise contribution of each AI model, compared with human analysis and other tools, remains unquantified.

Patch Guidance and Disclosure Details

PHP administrators should check the official PHP security advisories for CVE-2026-109618 and CVE-2026-109619, identify whether their deployed versions are affected, and apply the relevant fixed releases. Operators should also review deployment-specific guidance from PHP and the research teams as it becomes available. The source account points readers toward a separate patch and restart guide, but does not reproduce its instructions or version details.

Further clarity depends on the full advisories and technical write-ups: which versions are affected, how the flaws are triggered, and how the researchers’ findings map to the two CVEs. Until those details are available in the source record, claims about exposure and exploitation should remain qualified. The confirmed development is that PHP shipped fixes; the next practical milestone is for maintainers to publish or consult precise affected-version and remediation guidance.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used for two critical remote code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, for which PHP shipped fixes on October 21, 2026.

Who found the PHP vulnerabilities?

The source account credits Calif and Wiz Research with independent research into related PHP flaws. Calif reported findings to PHP in August 2026, and Wiz reported its finding on August 24, according to the teams’ accounts.

Did AI find the flaws without human researchers?

No such conclusion is supported by the source. It describes researchers choosing the target and directing the investigation, with AI tools assisting code review and related work. The contribution of each model is not independently quantified.

Are PHP sites being exploited in the wild?

The supplied material does not report confirmed exploitation in the wild or server compromises. It describes research testing and the release of fixes, but does not establish whether attackers used the flaws.

What should PHP operators do now?

Operators should consult PHP’s official advisories for CVE-2026-109618 and CVE-2026-109619, check their installed versions against the affected-version guidance, and apply the appropriate fixed release.

Source: ThorstenMeyerAI.com