🔍 Read the full analysis: Revisiting A 22-Year PHP Mystery Through AI-Assisted Review on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
PHP shipped fixes on October 21, 2026, for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. Calif’s account traces the research to a 2004 warning about unsafe memory-limit interruptions, while describing AI as a tool used alongside researchers’ prior knowledge. The full source account is incomplete here, and key details about the flaws and fixes remain unconfirmed.
PHP shipped fixes on October 21, 2026, for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. A retrospective by Thorsten Meyer, drawing on Calif’s research account, says the investigation revisited a 2004 warning about PHP requests being interrupted by memory limits at unsafe moments, with AI tools assisting researchers as they examined the runtime.
The retrospective credits Calif, OpenAI and Wiz with research into the vulnerabilities, and the PHP security team with the fixes. It frames the development as both a current security disclosure and a longer-running investigation into how PHP behaves when a request runs out of memory during sensitive operations. The source says the flaws permitted remote code execution, but the material provided here does not include the full technical explanation of their triggering conditions or the released patch versions.
The account traces one clue to PHP bug #78876, reported on November 28, 2019. The report described large multipart form fields causing out-of-memory failures and temporary files not being cleaned up. PHP fixed the issue in May 2020, and it received CVE-2019-11048 as a denial-of-service vulnerability. Calif later treated the leftover files as a prompt to ask what other state might remain after an out-of-memory termination.
According to the retrospective, Calif began focused work in July 2026 after joining OpenAI’s Patch the Planet initiative. Researcher Ryan Austin selected PHP based on his familiarity with its history and pursued a theory about older bug patterns. The account says Calif and Wiz worked separately and found the same class of flaw within weeks. The supplied source cuts off during its account of Wiz’s disclosure, so the complete timeline and the teams’ respective findings cannot be established from this material alone.
Infographic 01 · Timeline
One class of bug, four chances to catch it.
The flaws fixed on 21 October 2026 continue a line that starts with a 2004 advisory about unsafe interruptions.
- Jul 2004Stefan Esser: memory_limit can stop PHP “where an interruption is unsafe”Advisory 11/2004, CAN-2004-0594. Remote code execution was possible. (e-matters)
- 28 Nov 2019Bug #78876: long upload fields cause out-of-memory, temp files left behindFixed May 2020 as CVE-2019-11048, a denial-of-service issue at the time. (PHP bug tracker)
- 2024Quarkslab audit with OSTIF and the PHP FoundationAccording to Calif, it rediscovered the same OOM issue; exploitation was not proven, so it stayed open. (Calif, OSTIF)
- 30 Jul 2026Calif joins OpenAI’s Patch the Planet and picks PHPStefan Esser brings in the PHP Foundation through Volker Dusch. (Calif)
- 1–21 Aug 2026Calif finds several RCE paths and reports two bugs to PHPFirst report 11 Aug, working proof of concept 14 Aug, confirmed by PHP 15 Aug, second report 21 Aug. (Calif)
- 19–24 Aug 2026Wiz Research finds its first PHP flaw and reports on 24 AugUsing Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol; RCE confirmed on Drupal and WordPress. (Wiz)
- 21 Oct 2026PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 releasedCVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2. Public disclosure the same day. (PHP)
“…possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe.”Stefan Esser, e-matters Advisory 11/2004
Sources: e-matters Advisory 11/2004; PHP bug #78876; OSTIF; Calif: php2shell; Wiz Research (21 Oct 2026); PHP security advisory (21 Oct 2026).
Powered by Thorsten Meyer AI
How Old Memory Bugs Returned
The reported connection matters because it shows how an old security warning can remain relevant even after the specific pathways it identified have been fixed. The 2004 advisory concerned PHP’s memory-limit request termination: a safety mechanism could interrupt work at a point where cleanup or partially built data structures made interruption unsafe. The current disclosure suggests researchers revisited that broader class of risk, though the supplied material does not establish that the 2026 flaws were identical to the 2004 issue.
It also offers a more bounded account of AI-assisted security research than claims that models independently find every vulnerability. Calif’s account says the researcher selected the target and directed the investigation using knowledge of prior vulnerabilities. The practical lesson for maintainers is that AI tools may speed investigation, but human expertise and historical context remain part of the reported process. For PHP operators, the immediate relevance is the release of fixes for flaws described as critical and capable of remote code execution.
Products Worth Considering
Jackery Explorer 1000 v2 Portable Power Station
DJI Osmo Mobile 8 3-Axis Phone Gimbal Stabilizer
Samsung 37-inch Odyssey G7 Curved 4K UHD Gaming Monitor (G75F)
As an affiliate, we earn on qualifying purchases.
From Advisory to Audit Trail
In July 2004, security researcher Stefan Esser published Advisory 11/2004, “PHP memory_limit remote vulnerability,” on the Bugtraq mailing list. The retrospective quotes the advisory as warning that a remote attacker could trigger memory-limit termination where interruption was unsafe, potentially allowing code execution. PHP fixed the specific paths Esser reported, but the account says the broader challenge of interruption at unsafe points persisted.
A 2024 PHP audit by Quarkslab, conducted with OSTIF and the PHP Foundation, is another part of Calif’s account. The published results reportedly listed 27 findings and four CVEs, all resolved. Calif says auditors rediscovered the out-of-memory issue but did not prove exploitation, so it was not fixed at that time. OSTIF’s summary, as described in the source, does not mention such a finding. The distinction between Calif’s account and the public summary should be kept clear.
For the 2026 work, the source says Calif used generally available models and no special harness. It identifies OpenAI’s GPT-5.6 Sol in connection with Calif’s research. Wiz’s disclosure, as summarized by Meyer, says Wiz used its Wiz Atlas platform alongside Gemini 4 Argon and GPT-5.6 Sol. These are researcher and company descriptions; the supplied material does not independently evaluate how much each tool contributed.
“possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe”
— Stefan Esser, in the 2004 advisory as quoted in the retrospective
Patch Scope and Exploit Details
The supplied source does not specify which PHP versions were affected, which patched versions operators should install, or whether exploitation was observed in the wild. It also does not provide enough technical detail to explain how the two CVEs differ or whether they share the same underlying cause. Those points should not be inferred from the historical discussion alone.
The account’s description of the 2024 audit is attributed to Calif, while OSTIF’s published summary reportedly omits the out-of-memory issue. The source material also ends partway through the description of Wiz’s disclosure. As a result, the full disclosure chronology, the precise division of research credit, and the details of PHP’s response are not available here.
Operators Need the Release Details
PHP users should consult the PHP security advisories and release notes for the affected versions and the exact patched releases, then apply the appropriate updates. The source confirms that fixes shipped on October 21, 2026, but does not name the versions or provide deployment guidance. Organizations should rely on the project’s official notices rather than the retrospective’s historical narrative for patch decisions.
Further clarification from PHP, Calif and Wiz could establish the affected configurations, technical relationship between the two CVEs, and whether any exploitation has been detected. Until those details are available in the material provided, the confirmed development is limited to the reported vulnerabilities, the release of fixes, and the research teams’ accounts of how they found them.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used in the source account for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP shipped fixes on October 21, 2026.
What does the 2004 warning have to do with the 2026 flaws?
The retrospective says researchers revisited a 2004 warning about memory-limit termination happening at unsafe moments. It presents that warning as historical context and a clue, but the supplied material does not prove that the 2026 flaws are identical to the issue Esser reported.
Did AI find the vulnerabilities on its own?
No such conclusion is supported by the account. Calif researcher Ryan Austin says he chose the target and directed the work using knowledge of PHP’s vulnerability history. The source describes AI models as tools used during research, not as independent or exhaustive bug finders.
Which PHP versions should users update?
The source material does not list affected or patched PHP versions. Users should check the PHP project’s official security advisories and release notes for the version-specific instructions.
Source: ThorstenMeyerAI.com
