TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
PHP released fixes on Oct. 21, 2026, for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. Calif, OpenAI and Wiz are credited with research; the account links the flaws to a class of unsafe interruptions first described in a 2004 advisory, while some details about the relationship between earlier findings and the new vulnerabilities remain unclear.
The PHP security advisory assigned both flaws a CVSS v4.0 score of 9.2. The same day, the project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The advisory identifies the vulnerabilities and the affected releases, while the research accounts describe how the bugs were found and reported.
According to Calif’s account, the group joined OpenAI’s Patch the Planet program on July 30, 2026, and selected PHP for research. Calif says it reported its first issue on Aug. 11, produced a working proof of concept on Aug. 14, and received confirmation from PHP on Aug. 15. It reported a second issue on Aug. 21. Wiz Research separately says it found a PHP flaw in August using its Wiz Atlas system and models it identified as Gemini 4 Argon and GPT-5.6 Sol; it reported the issue on Aug. 24 and said it confirmed remote code execution on Drupal and WordPress.
The retrospective links these findings to a broader memory-handling problem, but it does not establish that every earlier report was the same vulnerability. PHP’s patch releases are confirmed; the historical connections and research details are attributed to the researchers’ accounts and cited records.
The 22-Year Road To PHP2Shell
How AI-assisted review finished an old story: two critical remote code execution flaws, a long trail of memory-handling concerns, and important questions the public record cannot yet answer.
A runtime fix with broad reach
PHP runs websites and applications, so remote code execution flaws can matter across many services. Researchers reported demonstrations on Drupal and WordPress; that does not mean every installation was vulnerable or compromised.
Two critical RCE flaws patched
PHP released security updates on Oct. 21, 2026, for CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. The advisory lists the vulnerabilities and affected releases.
AI-assisted review in the discovery story
Wiz says it found a PHP flaw in August using Wiz Atlas with Gemini 4 Argon and GPT-5.6 Sol. It reported the issue Aug. 24 and says it confirmed remote code execution on Drupal and WordPress.
From an old warning to a new fix
Researcher accounts connect the flaws through unsafe interruptions and memory handling. The dates below summarize those accounts and cited records; they do not prove every entry is one unchanged vulnerability.
Unsafe interruption warning
Stefan Esser’s e-matters Advisory 11/2004 (CAN-2004-0594) warned that memory-limit termination in sensitive code paths could enable remote code execution. PHP fixed the specific paths reported.
Out-of-memory clue
Bug #78876 described long multipart fields leaving temporary files after an out-of-memory condition. PHP fixed it as CVE-2019-11048, a denial-of-service issue.
Audit revisits the concern
Quarkslab’s PHP audit listed 27 findings and four CVEs, all resolved. Calif says the earlier issue resurfaced but exploitation was not proven. OSTIF’s summary does not mention it.
Calif reports two issues
Calif says it joined OpenAI’s Patch the Planet program July 30, reported its first issue Aug. 11, built a working proof of concept Aug. 14, received PHP confirmation Aug. 15, and reported a second issue Aug. 21.
Wiz report and public fixes
Wiz says it reported its finding Aug. 24. PHP published fixes for both PHP2Shell CVEs across four branches on Oct. 21.
A memory limit is meant to stop requests that consume too much memory. If the program is interrupted during a sensitive operation, it may be left in an unsafe state. The 2026 fixes address the newly reported flaws; they do not establish that every risk in this broader class is eliminated.
Confirmed facts and open edges
The timeline offers a plausible history of related concerns, while the exact links between findings remain only partly documented in the supplied material.
Updates are available
PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct. 21. Each CVE received a CVSS v4.0 score of 9.2.
Reports describe demonstrations
Calif describes a working proof of concept. Wiz says it confirmed RCE on Drupal and WordPress in research testing.
One continuous flaw?
The material does not establish that the 2004 advisory, 2019 bug, 2024 audit finding and two 2026 CVEs share one unchanged code path.
“Exploitation was not proven, hence the bug was not fixed.”Calif · describing the 2024 audit finding
Keep the historical connection in view
The story links several findings through a class of unsafe interruption and memory-handling problems. It does not fully detail the code paths or prove that each report describes the same vulnerability.
Calif’s description of the audit finding differs in emphasis from OSTIF’s published summary, which does not mention an out-of-memory issue. The characterization of that audit finding therefore rests on Calif’s account.
The supplied material also does not establish how many installations were exposed, how quickly users applied updates, or whether attackers used the flaws outside controlled research.
What PHP users should know
Consult PHP’s security advisory for the affected branch and the release that applies to your installation.
What are the two PHP2Shell vulnerabilities?
CVE-2026-109618 and CVE-2026-109619, remote code execution flaws fixed Oct. 21, 2026. PHP assigned each a CVSS v4.0 score of 9.2.
Which versions received fixes?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Check the official advisory for the release that matches your supported branch.
Were attacks confirmed in the wild?
The source material describes research demonstrations, but does not report exploitation against live systems. Whether attackers used the flaws is not established here.
How does the story connect to 2004?
Stefan Esser warned that PHP memory-limit termination could happen where an interruption was unsafe. The shared history is a reported connection, not proof that all findings are the same flaw.
Move to a fixed release
The immediate confirmed development is the availability of patched PHP releases. The source material provides no adoption deadline or patch uptake figures.
8.5.12 · 8.4.27 · 8.3.36 · 8.2.35
Further technical detail may clarify affected code paths, how the CVEs relate to older findings, and whether investigators found evidence of exploitation.
A Runtime Fix With Broad Reach
PHP is used to run web applications, so remote code execution flaws can matter across many sites and services. The researchers’ reported demonstrations on Drupal and WordPress illustrate potential exposure in software built on PHP, though they do not show that every installation was vulnerable or compromised.
The timeline also shows why security issues can persist in a broader form after a specific bug is fixed. A memory limit is intended to stop requests that consume too much memory. If an interruption happens during a sensitive operation, however, the program may be left in an unsafe state. The 2026 fixes address the newly reported vulnerabilities; they do not, by themselves, establish that every risk associated with unsafe interruptions has been eliminated.
For administrators, the immediate practical development is the availability of patched PHP releases. The source material does not report exploitation in the wild, so the severity scores and proof-of-concept accounts should not be read as evidence that attackers used the flaws against live systems.
PHP security vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From a 2004 Advisory to PHP2Shell
In July 2004, security researcher Stefan Esser published e-matters Advisory 11/2004, warning that a remote attacker could trigger PHP’s memory-limit termination “in places where an interruption is unsafe.” The advisory, identified as CAN-2004-0594, said the issue could allow code execution on remote PHP servers. PHP fixed the specific paths Esser reported, according to the supplied account.
A later clue appeared in PHP bug tracker report #78876, filed on Nov. 28, 2019. It described long multipart form fields causing an out-of-memory condition and leaving temporary files behind. PHP fixed the issue in May 2020 as CVE-2019-11048, a denial-of-service vulnerability. Calif’s account says the leftover files prompted researchers to ask whether an out-of-memory interruption could leave other structures in an unsafe state.
In 2024, Quarkslab audited PHP with the Open Source Technology Improvement Fund and the PHP Foundation. The published audit summary lists 27 findings and four CVEs, all resolved. Calif says the audit team encountered the earlier out-of-memory issue again but did not prove exploitation, so it remained open. OSTIF’s summary, as described in the source material, does not mention that issue; the characterization of the audit finding therefore rests on Calif’s account.
““possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe””
— Stefan Esser, e-matters Advisory 11/2004
web application security testing tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What the Timeline Cannot Confirm
The supplied material does not establish that the 2004 advisory, the 2019 out-of-memory bug, the 2024 audit finding and both 2026 CVEs are one unchanged vulnerability. It presents them as related through a class of unsafe interruption and memory-handling problems, while the specific code paths and relationship among the findings are not fully detailed here.
It is also not clear from the available account whether the 2026 flaws were exploited outside controlled research, how many installations were exposed, or how quickly PHP users applied the updates. Calif’s description of the 2024 audit finding differs in emphasis from OSTIF’s published summary, which does not mention an out-of-memory issue.
remote code execution vulnerability patch
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Patch Adoption and Further Detail
PHP users should consult the project’s advisory and move to a fixed release in their supported branch: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, released Oct. 21. The source material does not provide an adoption deadline or figures for patch uptake.
Further clarity may come from technical write-ups and any updates from PHP, Calif, OpenAI or Wiz. Those details could explain the affected code paths, how the two CVEs relate to the older reports, and whether investigators found evidence of exploitation. Until then, the confirmed public development is the release of fixes and the disclosure of two high-severity remote code execution flaws.
As an affiliate, we earn on qualifying purchases.
Key Questions
What are PHP2Shell’s two vulnerabilities?
They are CVE-2026-109618 and CVE-2026-109619, two remote code execution flaws PHP fixed on Oct. 21, 2026. PHP assigned each a CVSS v4.0 score of 9.2.
Which PHP versions received fixes?
PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct. 21, 2026. Users should check the PHP advisory for the release that applies to their branch.
Did researchers confirm attacks in the wild?
The source material describes research demonstrations, including reported confirmation on Drupal and WordPress, but does not report exploitation against live systems. Whether attackers used the flaws is not established here.
How does the story connect to 2004?
A 2004 advisory by Stefan Esser warned that PHP’s memory-limit termination could occur where an interruption was unsafe. The 2026 account traces a longer history of related concerns, but the available material does not prove that all the reports describe the same flaw.
Source: Thorsten Meyer AI
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
