TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
PHP released fixes on Oct. 21, 2026, for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. The research involved Calif, OpenAI and Wiz; Calif’s account connects the flaws to a memory exhaustion issue reported in 2019 and a broader warning dating to 2004.
PHP released fixes on Oct. 21, 2026, for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, after researchers at Calif, OpenAI and Wiz identified vulnerabilities in the widely used web runtime. The findings, known as PHP2Shell, connect new security work using AI-assisted review to an older class of bugs involving PHP interruptions during memory exhaustion.
The fixes are included in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both vulnerabilities were assigned a severity score of 9.2 under CVSS v4.0. PHP published its security advisory and public disclosure on the same day as the releases, according to the source material.
Calif’s account says its researchers selected PHP through OpenAI’s Patch the Planet initiative in July 2026. Calif reported two bugs to PHP in August: its first report was filed Aug. 11, a working proof of concept followed Aug. 14, and PHP confirmed the issue Aug. 15. Calif filed a second report Aug. 21. Wiz Research separately reported a PHP flaw on Aug. 24 and said its testing confirmed remote code execution in Drupal and WordPress. The source credits research to all three groups, though it does not detail how the findings overlap.
The account behind the retrospective was written by Ryan Austin of Calif and draws on Calif’s comic-style write-up. The source credits Michal Zalewski with the comic story and poster, and Stephanie Cortes of Ibis Craft with its illustrations. It says the article’s illustrations are new and do not reproduce that comic.
A Look Back at PHP2Shell and the AI-Assisted Review That Finished Its Story
PHP patched two critical remote code execution flaws on October 21, 2026. The findings connect a new review effort to a longer history of memory exhaustion and unsafe interruption in PHP.
“A memory limit can become a security boundary when an operation is interrupted in an unsafe state.”
The historical threadWhat PHP2Shell Means
PHP2Shell is the name used for two remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Remote code execution can allow an attacker to run code on a vulnerable server. The available source does not establish exploitation in the wild or the number of affected systems.
Fix and public notice
PHP published its advisory and security releases on the same day, October 21, 2026.
Three credited groups
The source credits Calif, OpenAI and Wiz. It describes separate research activity but does not detail how each finding overlaps.
Web applications at stake
Wiz reported confirming RCE in Drupal and WordPress. Exposure totals and patch adoption figures are not provided.
From 2004 Advisory to 2026 Fix
The retrospective follows a class of risk across more than two decades. A memory limit is meant to stop a request that consumes too much memory; interruption during an operation can leave incomplete state that cleanup then has to handle.
Early warning
Stefan Esser warned that memory-limit termination at an unsafe point could create a remote code execution risk.
Bug #78876
A report described long multipart fields exhausting memory and leaving temporary files behind.
DoS issue fixed
The reported denial-of-service issue became CVE-2019-11048. This does not establish that it enabled RCE.
Audit account differs
Calif says an audit rediscovered an out-of-memory issue. OSTIF’s public summary lists 27 findings and four CVEs, but does not mention it.
PHP2Shell patched
Two critical flaws disclosed alongside fixes for supported PHP branches.
AI-Assisted Review, With Human Confirmation
Calif says it selected PHP through OpenAI’s Patch the Planet initiative in July 2026. The reported process involved AI tools, researchers, PHP maintainers and independent reports; the source does not show that AI alone found or validated the flaws.
Wiz’s research account references Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol as part of its review process.
Researchers reported findings, PHP maintainers confirmed issues, and teams contributed evidence. Calif’s account says the first report went in August 11, a working proof of concept followed August 14, and PHP confirmed the issue August 15.
What Operators Should Know
Check the PHP branch running on each system and apply its corresponding October 21 security release. The source describes a patch-and-restart guide but provides no adoption numbers or later exposure assessment.
Were the flaws exploited before patching?
The source material does not establish whether either vulnerability was exploited in the wild.
How many servers were affected?
No count of vulnerable installations or patch adoption figures is available in the supplied account.
How do the two CVEs relate?
The supplied material does not give enough technical detail to establish the exact relationship between the CVEs or the separate findings.
Why reach back to 2004?
The earlier advisory raised the danger of triggering memory-limit termination where interruption is unsafe, a concern echoed in the later retrospective.
How a PHP Memory Bug Returned
The fixes matter because remote code execution can let an attacker run code on a vulnerable server. PHP is used across web applications, and Wiz reported confirming the issue in Drupal and WordPress. The source does not establish how many sites were exposed or whether the flaws were exploited before the fixes, so the scale of any real-world impact remains unknown.
The longer history also shows why a bug can reappear in a changed form. A memory limit is designed to stop a request that uses too much memory. But Calif’s account describes a risk when that stop occurs while the runtime is partway through an operation: the resulting cleanup may encounter incomplete state. That is a technical explanation of the reported class of weakness, not evidence that every memory exhaustion event is exploitable.
The research drew attention to AI-assisted vulnerability review, including Wiz’s use of Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. Those tools are part of the reported research process; the source does not show that AI alone found or validated the flaws. Human researchers, PHP maintainers and the credited teams were involved in reporting and confirming findings.
PHP security vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From 2004 Advisory to 2026 Fix
The timeline begins with a July 2004 advisory by security researcher Stefan Esser. He warned that an attacker could trigger PHP’s memory-limit termination at a point where interruption was unsafe, potentially enabling code execution on remote servers. PHP fixed the specific paths he reported, but the later account describes the broader challenge of handling interruptions safely.
On Nov. 28, 2019, PHP’s bug tracker received report #78876, concerning long multipart form fields that caused memory exhaustion and left temporary files behind. PHP fixed the reported denial-of-service issue in May 2020; it became CVE-2019-11048. Calif’s retrospective treats the leftover files as a clue that memory exhaustion could leave other state behind, but that interpretation does not establish that the 2019 bug itself enabled remote code execution.
A 2024 PHP audit by Quarkslab, with OSTIF and the PHP Foundation, is another part of Calif’s account. Calif says the audit rediscovered the same out-of-memory issue, but exploitation was not proven at the time. OSTIF’s published summary lists 27 findings and four CVEs and does not mention an out-of-memory issue. The distinction between Calif’s account and the published summary is relevant when tracing what was documented publicly.
““possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe.””
— Stefan Esser, e-matters Advisory 11/2004
As an affiliate, we earn on qualifying purchases.
Questions About Exposure and Exploitation
The available source material does not say whether either vulnerability was exploited in the wild, how many servers were vulnerable before the Oct. 21 releases, or how quickly operators installed the updates. It also does not provide technical details sufficient to establish the exact relationship between the two CVEs or the separate findings credited to Calif and Wiz.
The 2024 audit history is described differently across the material: Calif says the auditors rediscovered an out-of-memory issue, while OSTIF’s summary does not mention one. The source does not include the underlying audit finding or additional records that would resolve that difference.
web application security testing software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Patch Status Across PHP Deployments
Operators should check which PHP branch their systems use and apply the corresponding Oct. 21 security release. The listed fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The source describes a patch-and-restart guide but does not report adoption figures or a later assessment of exposure.
Further clarity would come from PHP’s technical advisories and follow-up reporting on affected deployments, exploitation evidence and the relationship between the reported findings. Until those details are available, the confirmed development is the release of fixes and the disclosure of two critical vulnerabilities; broader claims about impact remain unsettled.
remote code execution vulnerability patch
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used for two remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, for which PHP released fixes on Oct. 21, 2026.
Which PHP versions include the fixes?
The source lists fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Who is credited with the research?
The source credits Calif, OpenAI and Wiz. It describes separate research activity by Calif and Wiz and says the work took place in part through OpenAI’s Patch the Planet initiative.
Were the vulnerabilities exploited before PHP patched them?
The source material does not establish whether the vulnerabilities were exploited in the wild. It also does not give figures for vulnerable installations or patch adoption.
Why does the account reach back to 2004?
A 2004 advisory warned that triggering PHP’s memory limit during an unsafe interruption could create a security risk. Calif’s retrospective links that older class of concern to later memory exhaustion reports and the 2026 findings.
Source: Thorsten Meyer AI
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
