TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
PHP released fixes for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on Oct. 21, 2026. Calif, OpenAI and Wiz are credited with research that traced the flaws to unsafe memory-limit interruptions, a problem class PHP had addressed in earlier reports but that remained under investigation.
The PHP security team published fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both vulnerabilities carry a CVSS v4.0 score of 9.2, according to the source material. The reported impact is remote code execution, meaning a vulnerable server could be made to run attacker-controlled code. Administrators should consult PHP’s advisory for affected configurations and upgrade guidance.
Calif reported two bugs to PHP in August, with its first report submitted on Aug. 11. The source says Calif had a working proof of concept by Aug. 14 and PHP confirmed the issue the following day; a second report followed Aug. 21. Wiz Research separately reported a PHP flaw on Aug. 24. Wiz said it confirmed remote code execution in Drupal and WordPress environments. These details are attributed to the research groups’ accounts.
The reporting connects the 2026 vulnerabilities to an older issue: PHP’s memory-limit mechanism can interrupt execution at unsafe points while internal structures are being prepared. A forced stop at that moment may leave incomplete state for cleanup code to handle. The precise technical distinction between the two newly assigned CVEs is not detailed in the supplied account.
Security investigation · PHP · October 21, 2026
How AI-Assisted Review Brought The 22-Year PHP2Shell Story To A Close
PHP patched two critical remote code execution flaws linked to unsafe interruptions during memory-limit handling. The disclosures renew attention to a defect pattern first warned about in 2004.
CVE-2026-109618 · CVE-2026-109619
Both vulnerabilities rated critical in the supplied source.
Why the patches matter
PHP runs server-side code for websites and applications. Remote code execution can put hosted services and their data at risk.
Attacker-controlled code
The reported impact is remote code execution: a vulnerable server could be made to run code controlled by an attacker.
Review runtime versions
Site operators, hosting providers and application teams should identify their PHP branches and apply the relevant patched release.
A recurring defect pattern
The disclosures concern unsafe interruption during memory-limit handling. A related 2019 report was treated as denial of service; it did not establish the later RCE impact.
From a 2004 warning to patches
The supplied account connects earlier reports to the 2026 investigation while distinguishing what was confirmed at each stage.
Unsafe interruption warning
Stefan Esser warned that memory-limit termination at unsafe points could enable code execution. PHP fixed the paths described then.
Multipart form issue
A report described out-of-memory behavior and temporary files. PHP fixed it as CVE-2019-11048, characterized as denial of service.
Audit encounter
Calif says an audit encountered the issue, but exploitation was not proven. The cited OSTIF summary does not mention it.
Reports and validation
Calif reported two bugs and says it had a working proof of concept by Aug 14. Wiz separately reported a flaw and confirmed RCE in Drupal and WordPress environments.
PHP releases fixes
PHP published updates for two critical RCE vulnerabilities collectively called PHP2Shell.
How an interruption can leave unsafe state
Memory-limit enforcement can stop execution while internal structures are being prepared. Cleanup code may then encounter incomplete state.
PHP processes application input and prepares internal data structures.
The runtime forces an interruption during execution.
An unsafe stop can leave cleanup handling structures that are not fully prepared.
The two 2026 flaws were patched; consult PHP’s advisory for configuration details.
The supplied material does not detail the technical differences between the CVEs, identify vulnerable configurations, or report exploitation before disclosure. It also does not show that AI alone found the flaws or predict results in other software.
Check the PHP branch in use
These are the patched release versions listed in the source. Use PHP’s security advisory and release notes for affected branches and upgrade instructions.
Research, collaboration, remediation
The research groups describe separate work that contributed to the disclosures. PHP’s security team shipped the fixes.
“Possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe.”Stefan Esser · e-matters Advisory 11/2004
“Exploitation was not proven, hence the bug was not fixed.”Calif · account of the 2024 audit
Research and reporting
The source credits Ryan Austin with research and the write-up, Michal Zalewski with the comic story and poster, and Stephanie Cortes of Ibis Craft with illustrations.
Tools cited by the team
Wiz says it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol in its research.
Fixes shipped
Updates were released across PHP 8.5, 8.4, 8.3 and 8.2 on Oct. 21, 2026.
What operators should know
Use the official PHP security advisory as the source of truth for deployment-specific guidance.
What are PHP2Shell?
The name used for CVE-2026-109618 and CVE-2026-109619, two critical remote code execution flaws fixed on Oct. 21, 2026.
Which releases include fixes?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are listed. Check the PHP advisory for affected branches and upgrade instructions.
Who is credited with the research?
Calif, OpenAI and Wiz are credited. The source describes separate research and reporting by Calif and Wiz, followed by PHP security team fixes.
Were the flaws exploited?
The supplied source reports no exploitation or incident data for the period before disclosure.
Why PHP Server Operators Should Act
PHP runs server-side code for websites and applications, so remote code execution flaws can put hosted services and their data at risk. The 9.2 severity ratings and availability of fixes make prompt review of PHP versions important for site operators, hosting providers and teams responsible for PHP-based applications.
The episode also shows how a recurring defect pattern can remain relevant after an earlier report is fixed. The 2019 issue was handled as a denial-of-service vulnerability, while the 2026 disclosures concern remote code execution. That does not mean the earlier report itself established the later impact; the source describes the relationship as a line of investigation that researchers pursued.
AI-assisted tools formed part of the research process described by the groups, but the confirmed outcome is the discovery, reporting and patching of vulnerabilities. The source does not establish that AI alone found the flaws or that the methods will produce similar results in other software.
As an affiliate, we earn on qualifying purchases.
From a 2004 Warning to Patches
In July 2004, security researcher Stefan Esser warned that a remote attacker could trigger PHP’s memory-limit termination where interruption was unsafe. His advisory said the behavior could enable code execution on remote PHP servers. PHP fixed the specific paths described then, according to the supplied account.
A PHP bug report filed on Nov. 28, 2019, described long multipart form fields causing an out-of-memory condition and leaving temporary files behind. PHP fixed that issue in May 2020 as CVE-2019-11048, characterized at the time as denial of service. Calif’s account says a 2024 audit by Quarkslab, with OSTIF and the PHP Foundation, encountered the same out-of-memory issue, but exploitation was not proven then. OSTIF’s public summary, according to the source, lists 27 findings and four CVEs and does not mention that issue.
Calif joined OpenAI’s Patch the Planet program in July 2026 and selected PHP for review. The source credits Calif researcher Ryan Austin with the research and write-up, Michal Zalewski with the comic story and poster, and Stephanie Cortes of Ibis Craft with illustrations. It also credits the PHP security team with the fixes. Wiz says it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol in its research.
““Possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe.””
— Stefan Esser, e-matters Advisory 11/2004
remote code execution vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What the Disclosure Leaves Open
The supplied material does not specify which PHP configurations or deployment patterns are vulnerable, nor does it detail the technical differences between CVE-2026-109618 and CVE-2026-109619. Operators should use the PHP security advisory and release notes for those specifics.
It is also unclear how many systems were exposed or whether either flaw was exploited before disclosure. The source material reports the vulnerabilities and fixes but provides no exploitation or incident data. Calif’s description of the 2024 audit is its account; the cited OSTIF summary does not mention the out-of-memory issue.
As an affiliate, we earn on qualifying purchases.
Upgrading and Verifying PHP Systems
Administrators should identify the PHP branches running their services, review the PHP security advisory and install the applicable patched release. The released versions listed in the source are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Teams should also check that deployed applications and hosting environments are using the updated runtime.
Further technical detail may come from the PHP advisory and the credited researchers’ reports. The supplied material does not give a timetable for additional disclosures or follow-up analysis, so the next confirmed milestone is operators applying and verifying the patches.
As an affiliate, we earn on qualifying purchases.
Key Questions
What are PHP2Shell?
PHP2Shell is the name used in the source for CVE-2026-109618 and CVE-2026-109619, two critical remote code execution flaws fixed by PHP on Oct. 21, 2026.
Which PHP versions include the fixes?
The source lists PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as the patched releases. Check PHP’s advisory for affected branches and upgrade instructions.
Who is credited with finding the vulnerabilities?
The research is credited to Calif, OpenAI and Wiz. The source describes separate research and reporting by Calif and Wiz, followed by fixes from the PHP security team.
Were the flaws exploited before they were fixed?
The supplied source does not report whether either vulnerability was exploited before disclosure. It provides no incident data on attacks against vulnerable systems.
Source: Thorsten Meyer AI
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
