TL;DR
PHP released fixes on October 21, 2026, for two critical remote code execution vulnerabilities known as PHP2Shell. Calif, OpenAI and Wiz are credited with research that connected the flaws to a long-running memory-limit issue; the account describes earlier warnings and audit findings, but does not establish that every prior finding was exploitable.
The fixes are included in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to the PHP security advisory cited in the source account. The disclosure identifies two vulnerabilities, but the supplied material does not give their technical details or state how many systems were exposed. PHP maintainers fixed the issues; the research credit goes to Calif, OpenAI and Wiz.
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Calif’s account says its researchers began examining PHP in August 2026 through OpenAI’s Patch the Planet program. Calif reported one issue on August 11, developed a working proof of concept on August 14, and says PHP confirmed it on August 15. Calif reported a second issue on August 21. Separately, Wiz Research says it found and reported a PHP flaw on August 24, using Wiz Atlas alongside Gemini 4 Argon and GPT-5.6 Sol; Wiz reported remote code execution confirmed on Drupal and WordPress. These are descriptions from the research groups, rather than independent findings detailed in the supplied material.
The account frames the investigation as a longer chain of clues. It links the 2026 fixes to a 2004 warning about memory-limit termination at unsafe points, a 2019 bug report about upload fields causing out-of-memory conditions and leaving temporary files, and a 2024 audit. The earlier report was fixed in 2020 as CVE-2019-11048, then treated as a denial-of-service issue. The source says Calif later revisited the out-of-memory behavior as a possible lead.
Security investigation · PHP · October 2026
What AI-Assisted Review Revealed About The Long PHP2Shell Story
Two critical remote code execution flaws led researchers back through decades of clues about PHP’s memory-limit behavior. The account connects that history while leaving key technical and exposure questions unanswered.
01 / The investigation
A memory-limit clue, revisited
PHP’s memory limit stops resource-heavy requests. Researchers say an interruption while internal state is only partly set up can leave unsafe conditions. The source account presents this as the route to PHP2Shell, without claiming that the older warning and the new flaws were identical.
AI-assisted review
Calif says it began examining PHP in August through OpenAI’s Patch the Planet program. Wiz separately describes using Wiz Atlas with Gemini 4 Argon and GPT-5.6 Sol.
Web software in scope
PHP supports web servers and applications such as Drupal and WordPress. Wiz reports confirmed remote code execution in both; the account gives no affected-system estimate.
Update the PHP runtime
Four patched releases are listed. Consult PHP’s security advisory for the release relevant to your installation and its upgrade guidance.
02 / A long chain of clues
From an old warning to new fixes
The account links separate reports and findings across 22 years. These are investigative connections; they do not establish that every earlier finding was exploitable.
Stefan Esser’s advisory warned that a remote attacker could trigger memory-limit termination at unsafe points.
Bug #78876 described long multipart fields and temporary files left uncleaned after an out-of-memory condition.
The report became CVE-2019-11048, treated as a denial-of-service vulnerability.
Calif says an audit rediscovered the behavior; exploitation was not proven. OSTIF’s summary reportedly omits it.
Calif and Wiz describe separate research and reports. PHP published fixes on October 21.
“possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe”
Stefan Esser · e-matters Advisory 11/2004
03 / Patch status
Four branches, two critical CVEs
PHP says the October 21 fixes address CVE-2026-109618 and CVE-2026-109619. Verify the appropriate release for your deployment against the PHP security advisory.
Patched releases
PHP 8.5.12 · PHP 8.4.27
PHP 8.3.36 · PHP 8.2.35
Separate reports
Calif reports dates from August 11 through August 21, including a working proof of concept. Wiz says it reported a flaw on August 24.
Evidence has limits
Wiz reports execution confirmed on Drupal and WordPress. These are research-group descriptions, not independent technical findings detailed here.
Administrators should consult the PHP advisory and upgrade to the release appropriate for their branch. The source account recommends patching and restarting PHP services, but does not provide a verified deployment checklist or guidance for systems that cannot update.
04 / What remains unknown
The public account leaves open
The supplied material names the flaws and patched versions, but lacks the full PHP advisory and technical descriptions needed to answer several operational questions.
What conditions enable exploitation?
The precise requirements, affected configurations, and whether the CVEs use the same code paths are not established here.
Was either flaw exploited in the wild?
The account says nothing about attacks before disclosure and gives no count of affected or unpatched systems.
Are other mitigations available?
No application-specific mitigations or guidance for installations unable to update are provided.
What exactly did the 2024 audit find?
The audit connection is attributed to Calif. OSTIF’s published summary reportedly does not mention an out-of-memory finding.
Why PHP’s Memory Limit Came Under Scrutiny
PHP runs on a large number of web servers and underpins software such as Drupal and WordPress, so remote code execution vulnerabilities can have consequences beyond a single application. The source account says Wiz confirmed execution in both systems, but provides no estimate of affected installations or evidence of attacks in the wild.
The investigation also shows how a bug first understood as a reliability or denial-of-service problem can warrant renewed security scrutiny. A memory limit is intended to stop resource-intensive requests. If PHP is interrupted while internal state is only partly set up, researchers say cleanup may leave unsafe conditions. The account presents that connection as the path to PHP2Shell; it does not claim that the 2004 advisory and the 2026 vulnerabilities were identical flaws.
For operators, the immediate consequence is practical: the affected PHP branches have updates, and the two vulnerabilities received high severity scores. The source points readers to a separate patch-and-restart guide, but does not specify deployment timelines, mitigations for systems that cannot update, or whether exploitation has been observed.
Products Worth Considering
Samsung 32-Inch Odyssey G5 QHD 180Hz Gaming Monitor
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
Amazon Kindle Scribe Colorsoft 64GB with 11-Inch Color Display and Premium Pen, Graphite
As an affiliate, we earn on qualifying purchases.
From a 2004 Warning to 2026 Fixes
In July 2004, security researcher Stefan Esser published e-matters Advisory 11/2004, warning that a remote attacker could trigger PHP’s memory-limit termination “in places where an interruption is unsafe.” The advisory, identified as CAN-2004-0594, said remote code execution was possible. PHP fixed the specific paths Esser reported, according to the source account.
On November 28, 2019, PHP bug tracker report #78876 described long multipart form fields causing an out-of-memory condition and leaving temporary files uncleaned. PHP fixed the issue in May 2020; it became CVE-2019-11048, a denial-of-service vulnerability. Calif’s later investigation treated the leftover-file behavior as a clue to examine what else an out-of-memory interruption might leave behind.
In 2024, Quarkslab audited PHP with the Open Source Technology Improvement Fund and the PHP Foundation. The audit’s published results reportedly listed 27 findings and four CVEs, all resolved. Calif says the audit rediscovered the out-of-memory issue, but that exploitation was not proven at the time. OSTIF’s summary, as described in the source, does not mention that issue, so the account of this finding rests on Calif’s description.
““possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe””
— Stefan Esser, e-matters Advisory 11/2004
What the Public Account Leaves Open
The supplied material does not include the full PHP advisory or technical descriptions of CVE-2026-109618 and CVE-2026-109619. It therefore does not establish the precise conditions needed for exploitation, whether the two CVEs affect the same code paths, or which configurations are vulnerable.
It is also unclear whether attackers exploited either flaw before the October 21 disclosure, how many systems remain unpatched, and whether additional application-specific mitigations are available. The 2024 audit connection is attributed to Calif; the source notes that OSTIF’s published summary does not mention an out-of-memory finding. No independent audit record confirming that detail is provided here.
Patches and Further Disclosure
PHP has released updates for four maintained branches: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Administrators should consult the PHP security advisory for the affected versions and upgrade guidance. The source account recommends patching and restarting PHP services, but does not provide a verified deployment checklist or a timetable for systems that cannot update.
Further clarity depends on the full vulnerability advisories and any follow-up from PHP, Calif, OpenAI or Wiz. Those details could establish affected configurations, practical mitigations and whether there is evidence of exploitation. The source material does not give a date for additional disclosures.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used for two remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, fixed by PHP on October 21, 2026.
Which PHP versions include the fixes?
The source lists patched releases PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Check the PHP security advisory to confirm the release relevant to your installation.
Who is credited with finding the flaws?
The source credits research groups Calif, OpenAI and Wiz. It describes separate reporting by Calif and Wiz; PHP’s security team released the fixes.
Were the vulnerabilities exploited in the wild?
The supplied material does not say whether either flaw was exploited before disclosure. It also provides no count of affected or unpatched systems.
How does the story connect to 2004?
A 2004 advisory by Stefan Esser warned that triggering PHP’s memory limit during an unsafe interruption could create a security risk. The source account traces a line from that warning to the 2026 investigation, while not establishing that the old and new vulnerabilities were identical.
Source: Thorsten Meyer AI
