How A Long PHP Security Trail Led To The PHP2Shell Story

🔍 Read the full analysis: How A Long PHP Security Trail Led To The PHP2Shell Story on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP released fixes on October 21, 2026, for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now referred to as PHP2Shell. A retrospective published by Thorsten Meyer on October 22 traces the security story from a 2004 warning about unsafe request interruptions through later out-of-memory reports to research credited to Calif, OpenAI and Wiz. The vulnerabilities matter because PHP powers a large share of web applications, but the supplied account does not provide affected versions, patch identifiers or complete technical details.

The retrospective presents PHP2Shell not as a sudden discovery, but as a long trail of questions about what happens when a PHP request runs out of memory during sensitive operations. In July 2004, security researcher Stefan Esser warned that a remote attacker could trigger PHP’s memory-limit termination at a point where stopping execution was unsafe. His advisory said this could potentially be abused to run code on remote PHP servers. PHP fixed the specific paths he reported, while the broader risk of interruptions at unsafe moments remained a concern.

A later report offered another clue. On November 28, 2019, PHP’s issue tracker received bug #78876, describing large multipart form fields that caused an out-of-memory condition and left temporary files behind. PHP fixed the issue in May 2020; it was tracked as CVE-2019-11048 and treated as a denial-of-service vulnerability because the leftover files could consume disk space. Calif’s account says the incident prompted researchers to ask what other state might remain after memory exhaustion.

In 2024, PHP was audited by Quarkslab with OSTIF and the PHP Foundation. The published audit summary lists 27 findings and four CVEs, all resolved. Calif says the auditors encountered the same out-of-memory issue but did not prove exploitation, so it was not fixed at that point. In summer 2026, Calif researcher Ryan Austin pursued the older line of inquiry as part of OpenAI’s Patch the Planet initiative. Calif says it found multiple paths to remote code execution on August 1 and reported vulnerabilities to PHP later that month. Wiz Research worked separately: its disclosure says it found a vulnerability on August 19, validated unauthenticated code execution against Drupal and WordPress, and reported it to PHP on August 24.

Why Unsafe Memory Stops Matter

The story matters because it connects a familiar safety mechanism to a less obvious security risk. A memory limit is intended to stop a request before it consumes too many resources. But if execution stops while internal state is only partly prepared, cleanup may encounter structures that are not safe to use. The 2004 advisory, 2019 temporary-file issue and 2026 PHP2Shell flaws are presented as points in a long-running investigation into that general problem, rather than as proof that one bug remained unchanged for 22 years.

For operators, the immediate implication is practical: PHP installations need the relevant fixes, and teams should consult PHP’s release information to identify affected versions and upgrade paths. Applications built on PHP, including widely used content-management systems, may depend on the runtime even when their own code is not the source of the flaw. The reported validation against Drupal and WordPress underscores why runtime security can affect many services, although the supplied material does not establish the exposure of every deployment.

The research also offers a measured lesson about AI-assisted security work. Calif’s account describes a researcher with experience of PHP’s vulnerability history directing the investigation, while OpenAI and Wiz attribute contributions to AI models and tools. That is different from showing that a model independently found the flaw. The result highlights how older security knowledge can guide automated review, without establishing that AI tools can find vulnerabilities comprehensively or replace expert analysis.

From 2004 Advisory to PHP2Shell

Esser’s 2004 advisory focused on the possibility that PHP could be forced to terminate a request during an unsafe operation. The basic concern was not simply that a request might crash: an interruption could leave partially constructed state for cleanup code to handle. PHP fixed the specific cases described in that advisory, according to the retrospective, but the source frames the wider class of interruption-related problems as difficult to eliminate.

The 2019 tracker report concerned a concrete consequence of memory exhaustion: temporary upload files remained on disk after a request failed. Its recorded impact was denial of service, not remote code execution. The 2024 audit account adds another stage, but the public audit summary cited by Meyer does not mention an out-of-memory finding; the claim that auditors rediscovered it comes from Calif. Keeping those records distinct matters: a reported similarity does not by itself establish that the same vulnerability persisted or that exploitation was then possible.

Calif’s timeline says OpenAI invited the group into Patch the Planet in 2026, and that the PHP Foundation was brought into the work through Volker Dusch. Calif says it used generally available models without a special harness. Wiz’s disclosure describes a separate effort using its Wiz Atlas platform alongside Gemini 4 Argon and GPT-5.6 Sol. The account credits the research to Calif, OpenAI and Wiz, and the fixes to the PHP security team.

““possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe””

— Stefan Esser, in his July 2004 advisory as quoted in the retrospective

Details Still Missing From the Account

The source material identifies the two CVEs and says PHP shipped fixes on October 21, 2026, but it does not specify which PHP branches or versions are affected, the fixed release numbers, or the exact patch and upgrade instructions. It also does not give the vulnerabilities’ full technical mechanisms, so readers cannot determine from this account alone which configurations are exposed or whether particular deployments were exploited.

Some elements of the historical chain are attributed to Calif rather than confirmed by the public records cited in the article. In particular, the 2024 audit summary does not mention the out-of-memory issue, and the claim that auditors rediscovered it comes from Calif. The material also ends partway through its account of OpenAI’s announcement about Wiz, leaving the complete disclosure timeline and the organizations’ respective findings unclear. No evidence of attacks in the wild is provided.

Patch Guidance and Disclosure Follow-Up

PHP users should check the PHP project’s security announcements and release notes for the affected branches, fixed versions and upgrade steps, then apply the appropriate update. The source says a separate patch guide was available, but does not include its instructions or identify the versions requiring updates. Application owners should also check with their hosting providers and software vendors where they do not manage PHP directly.

Further clarity depends on the PHP project’s advisories and fuller technical disclosures from the research teams. Those records should establish the affected configurations, how the two CVEs relate to the older memory-handling concerns, and whether any exploitation has been observed. Until those details are available, the confirmed development is that PHP has shipped fixes; the historical connection and AI contributions remain as described and attributed by the researchers and organizations.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used in the supplied account for two critical remote code execution flaws in PHP: CVE-2026-109618 and CVE-2026-109619. PHP released fixes on October 21, 2026.

What is the connection to the 2004 advisory?

Stefan Esser’s 2004 advisory warned that a remote attacker might trigger PHP’s memory-limit termination during an unsafe interruption point. The retrospective links that concern to a longer history of investigating what happens when PHP requests run out of memory, but it does not establish that the 2026 vulnerabilities were the same bug.

Did the 2019 issue allow remote code execution?

The 2019 report, CVE-2019-11048, was treated as a denial-of-service issue involving leftover temporary files after an out-of-memory failure. The supplied account does not say that this issue enabled remote code execution.

Which researchers and tools are credited?

The article credits research to Calif, OpenAI and Wiz, with fixes made by the PHP security team. Calif describes AI-assisted work, while Wiz says it used Wiz Atlas with Gemini 4 Argon and GPT-5.6 Sol. Those are attributed accounts of the teams’ methods and contributions.

How can PHP users check whether they need an update?

Check PHP’s official security announcements and release notes for the affected branches and fixed versions. The source material does not list those version numbers, so users should consult the project’s current advisory or their hosting provider before deciding whether a deployment is affected.

Source: ThorstenMeyerAI.com