TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
PHP released fixes for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on Oct. 21, 2026. The research account links the discoveries to a long-running class of unsafe interruptions when PHP runs out of memory, but the 2004, 2019 and 2024 episodes are not all the same confirmed vulnerability. PHP credited Calif, OpenAI and Wiz with research; the PHP security team issued the fixes.
PHP released fixes on Oct. 21, 2026, for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, after research by Calif, OpenAI and Wiz. Both vulnerabilities received a CVSS v4.0 score of 9.2. The disclosures matter to organizations running PHP applications because a successful remote code execution attack can let an attacker run code on a server; the available account does not establish how many systems were exposed or whether either flaw was exploited.
The PHP security team released patched versions of four branches: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP advisory published on the same date identifies the two CVEs. The supplied research account says Calif reported two bugs in August: its first report was sent on Aug. 11, a working proof of concept followed on Aug. 14, and PHP confirmed the issue on Aug. 15. Calif reported a second bug on Aug. 21.
Separately, Wiz Research says it found a PHP flaw in August and reported it on Aug. 24. Its account says Wiz used its Atlas platform with Gemini 4 Argon and GPT-5.6 Sol, and that remote code execution was confirmed on Drupal and WordPress. Those are claims attributed to Wiz in the supplied material; the available account does not provide independent test results or detail the conditions needed to reproduce the findings.
The research story has been described under the name PHP2Shell. The source account credits research to Calif, OpenAI and Wiz, and credits the fixes to the PHP security team. It also says the retelling draws on Calif’s comic-style write-up, with research and writing by Ryan Austin, a story and poster by Michal Zalewski, and illustrations by Stephanie Cortes of Ibis Craft. Those credits describe the research presentation; they do not change the PHP advisory’s status as the source for the released versions and CVE identifiers.
Security timeline · PHP2Shell
From Old Mystery To Review: The 22-Year Path To PHP2Shell
Two critical remote code execution flaws were patched in PHP on October 21, 2026. The research story reaches back to older reports about unsafe interruptions and out-of-memory behavior—but the historical episodes are clues, not proof of one continuous vulnerability.
01 / Why operators should care
Remote code execution changes the stakes
A successful remote code execution attack can let an attacker run code on a server. PHP powers web applications, including systems built with Drupal and WordPress. Risk to any specific site depends on its PHP version, configuration, application setup and whether the vulnerable code path is reachable.
Severity
Critical ratings
Both flaws received CVSS v4.0 scores of 9.2. A severity score measures assessed risk; it does not show that attacks are occurring or that every installation is vulnerable.
Operator action
Check, then update
Identify the PHP branch in use, apply its corresponding fixed release, and confirm that applications and hosting environments run the updated build.
Evidence limit
Impact is unquantified
The supplied account does not estimate exposed servers, update rates, attack activity, or the conditions required to reproduce either issue.
02 / Patch status
Fixed builds across four branches
PHP published fixes and identified both CVEs on October 21, 2026. Match the release to the branch your applications use, then verify the running version.
03 / The longer trail
Reports that shaped the investigation
The history connects observations about memory limits and interruption safety. It does not establish that every episode was the same bug—or that earlier findings were exploitable in the same way as the 2026 flaws.
An early warning
Stefan Esser’s e-matters Advisory 11/2004 (CAN-2004-0594) warned that memory-limit termination could occur where interruption was unsafe. PHP fixed the specific paths reported then.
A denial-of-service clue
Bug #78876 described multipart fields causing out-of-memory conditions and leftover temporary files. Fixed in May 2020 as CVE-2019-11048, it was treated as denial of service, with disk-filling risk.
Audit, unresolved question
A Quarkslab audit with OSTIF and the PHP Foundation listed 27 findings and four resolved CVEs. Calif says auditors rediscovered the issue but could not prove exploitation, so it was not fixed then.
Research to release
Calif selected PHP through OpenAI’s Patch the Planet program. Calif and Wiz reported findings in August; PHP published two critical fixes on October 21.
“possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe.”
Stefan Esser · e-matters Advisory 11/2004
“exploitation was not proven, hence the bug was not fixed.”
Calif · As quoted in the supplied research account
04 / August research reports
Separate reports, attributed findings
The supplied account gives a sequence for Calif’s reports and a separate account from Wiz Research. Specific platform findings below are attributed to Wiz; independent test results and reproduction conditions are not included.
Calif · August
Two reports to PHP
First report sent August 11; a working proof of concept followed August 14; PHP confirmed the issue August 15. Calif reported a second bug August 21.
Wiz Research · August
Platform-assisted discovery
Wiz says it reported a PHP flaw on August 24 using Atlas with Gemini 4 Argon and GPT-5.6 Sol, and confirmed RCE on Drupal and WordPress. These are Wiz’s claims as presented in the supplied account.
05 / What remains unknown
Keep the historical link in perspective
An out-of-memory event can disrupt service, but disruption alone does not prove code execution. The available account places older reports in the investigation’s background without establishing one continuous vulnerability.
06 / From report to response
A research story with clear attribution
The PHP advisory remains the reference for released versions and CVE identifiers. The research presentation adds context and creative credits without changing the status of that advisory.
Research
Calif · OpenAI · WizResearch credited in the supplied accountValidation
Reports reviewedAccounts describe reports and proof-of-concept workResponse
PHP security teamFixes released across four PHP branchesPresentation
PHP2ShellComic-style write-up, story, poster and illustrationsThe supplied account credits research and writing to Ryan Austin, a story and poster to Michal Zalewski, and illustrations to Stephanie Cortes of Ibis Craft.
07 / Key questions
What readers should know
What is PHP2Shell?
The name used in the supplied account for two remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, fixed by PHP on October 21, 2026.
Which versions received fixes?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Check the PHP security advisory for guidance that applies to your installation.
Were the flaws exploited?
The supplied material does not confirm whether either vulnerability was exploited, or estimate how many systems were exposed.
What is the practical next step?
Inventory the PHP versions serving your applications, update to the applicable fixed build, and verify the version running in production.
Why PHP Server Fixes Matter
Remote code execution flaws can carry serious consequences because they may allow an attacker to run commands or code on a vulnerable server. PHP is used to power web applications, including systems built with popular platforms such as Drupal and WordPress. The risk to any specific site depends on its PHP version, configuration, application setup and whether the vulnerable code path is reachable.
The two 9.2 CVSS v4.0 ratings indicate that the issues were assessed as critical in the source material. A score is a measure of severity, not evidence that attacks are happening or that every PHP installation is vulnerable. The release of patched builds gives operators a concrete action: identify affected installations and move to an applicable fixed version. The supplied material does not quantify the number of exposed servers, the scale of potential impact or the rate at which systems are being updated.
The longer history also matters for how security findings are interpreted. An out-of-memory condition can cause service disruption, but a disruption alone does not prove that an attacker can execute code. The account connects earlier reports and audits to the investigation, while distinguishing those earlier episodes from the two vulnerabilities patched in 2026.
As an affiliate, we earn on qualifying purchases.
A Trail Through PHP Reports
In July 2004, security researcher Stefan Esser published e-matters Advisory 11/2004, identified in the source as CAN-2004-0594. Esser warned that a remote attacker could trigger PHP’s memory-limit request termination “in places where an interruption is unsafe,” and said the issue could be abused to run code on remote PHP servers. PHP fixed the specific paths reported at the time. The 2026 account presents the advisory as an early warning about a class of failures, not as proof that the later CVEs are the same bug.
On Nov. 28, 2019, a report in PHP’s bug tracker, #78876, described long multipart form fields causing an out-of-memory condition and leaving temporary files behind. PHP fixed the issue in May 2020; it became CVE-2019-11048 and was treated as a denial-of-service problem. The report’s documented impact was that files left on disk could fill storage. Calif later viewed it as a clue about what else an out-of-memory interruption might leave in an unsafe state.
In 2024, Quarkslab conducted a PHP audit with OSTIF and the PHP Foundation. OSTIF’s published summary lists 27 findings and four CVEs, all resolved, but does not mention the out-of-memory issue described by Calif. Calif says the auditors rediscovered that issue but could not prove exploitation, so it was not fixed then. In July 2026, Calif joined OpenAI’s Patch the Planet program and selected PHP; its account says Stefan Esser connected the effort with the PHP Foundation through Volker Dusch. This sequence supplies background to the 2026 research without establishing that every earlier observation was an exploitable remote code execution flaw.
““possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe.””
— Stefan Esser, e-matters Advisory 11/2004
remote code execution vulnerability tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Questions About Exposure Remain
The supplied material does not say whether attackers exploited either 2026 vulnerability before the patches were released, how many servers remain unpatched, or whether the flaws require particular configurations or application behavior. It also does not give enough technical detail to map each CVE to a specific affected code path or to explain the difference between the two flaws. Readers should rely on the PHP security advisory and their own system inventory for version-specific guidance.
The historical link needs similar care. The 2004 advisory, the 2019 denial-of-service issue and the 2024 audit account are presented as part of a longer investigation into unsafe interruption and out-of-memory behavior. The available sources do not establish that they are one continuous vulnerability, or that the older findings were exploitable in the same way as the 2026 flaws.
As an affiliate, we earn on qualifying purchases.
Patch Status Will Shape Risk
Operators should check which PHP branch their applications use and apply the corresponding fixed release listed by PHP: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. They should also confirm that their applications and hosting environments are actually running the updated PHP build. The supplied material does not provide a separate mitigation for systems that cannot upgrade immediately.
Further reporting and PHP security updates may clarify affected configurations, technical differences between the CVEs and whether exploitation has been observed. Until then, the confirmed development is the release and public disclosure of two critical flaws, alongside a patch set for four PHP branches. The scale of exposure and any attack activity remain unknown in the source material.
web application security testing tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used in the supplied account for two remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, fixed by PHP on Oct. 21, 2026.
Which PHP versions received fixes?
PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Operators should check the PHP security advisory for guidance that applies to their installations.
Were the flaws exploited?
The supplied source material does not confirm whether either vulnerability was exploited. It also does not estimate how many systems were exposed or remain unpatched.
Are the 2026 flaws the same as the 2004 advisory?
The account links the events through a broader concern about unsafe interruptions and memory-limit behavior. It does not establish that the 2004 advisory and the 2026 CVEs are the same vulnerability.
Source: Thorsten Meyer AI
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
