TL;DR
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
PHP released fixes for two critical remote code execution vulnerabilities on Oct. 21, 2026. Calif, OpenAI and Wiz are credited with the research; Calif’s account links the findings to a security concern first described in 2004, though the exact relationship between the older issues and the new flaws is not fully established in the supplied material.
PHP released fixes on Oct. 21, 2026, for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, in research credited to Calif, OpenAI and Wiz. The flaws, both rated 9.2 under CVSS v4.0, affect a programming language used across much of the web; Calif’s account places the work in a longer history of PHP memory-limit interruptions, while the precise technical link to the 2004 issue is not fully detailed in the available material.
The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP published the fixes and public disclosure on the same day. The source account says Calif reported two bugs in August, with a working proof of concept on Aug. 14 and PHP confirmation on Aug. 15. Calif’s research and write-up are by Ryan Austin; PHP’s security team made the fixes.
Wiz Research reported a separate PHP flaw on Aug. 24, after finding it between Aug. 19 and Aug. 24, according to Wiz. The company said it used Wiz Atlas with Gemini 4 Argon and GPT-5.6 Sol, and that remote code execution was confirmed on Drupal and WordPress. The supplied material does not map each credited research group to each CVE, so those findings should not be treated as one identical discovery.
The reporting traces an earlier strand to a 2004 advisory by Stefan Esser, which warned that an attacker could trigger PHP’s memory-limit termination at an unsafe point. A 2019 PHP bug report later described out-of-memory errors leaving temporary upload files behind; PHP fixed it in 2020 as CVE-2019-11048, then described as a denial-of-service issue. Calif says auditors encountered the same out-of-memory issue during a 2024 review, but exploitation was not proven at that time.
Security Research · PHP Runtime · October 21, 2026
The Long Road To PHP2Shell: AI-Assisted Review And An Old Story
PHP patched two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. Research credited to Calif, OpenAI and Wiz revisits a longer history of memory-limit behavior—but the available details do not establish that the older and newer issues share a root cause.
Why PHP Runtime Fixes Matter
Remote code execution can allow an attacker to run code on a vulnerable server. Operators should identify each deployed PHP branch and apply its matching patch.
Server-side risk
PHP powers web applications. A vulnerable runtime can put the server and connected services at risk if the flaw is reachable.
High score, limited scope
Both flaws score 9.2 under CVSS v4.0. That rating signals severity; it does not show how many systems are affected or whether attackers exploited them.
Revisit old assumptions
An issue first treated as reliability or denial of service may merit fresh review as researchers learn more. A historical connection is not proof of shared mechanics.
for each 2026 vulnerability
From Memory Limits to New CVEs
Calif’s account places the 2026 work in a longer timeline. The source material does not prove that these reports describe the same underlying bug.
Unsafe interruption warning
Stefan Esser’s e-matters Advisory 11/2004 warned that remote requests could trigger memory-limit termination at unsafe points.
Temporary upload files
PHP bug #78876 described out-of-memory errors leaving temporary files. PHP fixed it as CVE-2019-11048, then described as denial of service.
Audit rediscovers issue
Calif says an audit with Quarkslab, OSTIF and the PHP Foundation encountered the issue. Exploitation was not demonstrated; it remained open.
New research reported
Calif joined OpenAI’s Patch the Planet program on July 30 and selected PHP. Calif reported findings in August; Wiz reported a separate finding later that month.
PHP ships fixes
PHP published two critical RCE fixes and four patched releases. Research credit names Calif, OpenAI and Wiz.
“possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe.”Stefan Esser · e-matters Advisory 11/2004
What the Timeline Cannot Establish
The supplied reporting leaves key technical and attribution questions open.
| Question | What the material says | Status |
|---|---|---|
| CVE-to-research mapping | Calif, OpenAI and Wiz receive research credit; the source does not assign each group to a specific CVE. | Not specified |
| Shared historical root cause | Calif connects the work to memory-limit interruptions, but the 2004, 2019 and 2026 issues are not shown to be identical. | Unproven |
| Prior exploitation | The source does not say whether either 2026 flaw was exploited before disclosure. | Unknown |
| Scope and configurations | No confirmed installation count or complete list of vulnerable configurations is provided. | Not specified |
The 2024 audit detail is attributed to Calif. The supplied account says OSTIF’s published summary does not mention the out-of-memory finding. Calif’s narrative is the source for the connection; the confirmed development is PHP’s release of two new fixes.
Apply the Matching PHP Release
Check the version running in every application and hosting environment, then update to the corresponding patched release.
PHP versions may be managed separately across applications, containers and hosting deployments. Match the update to each supported branch. Further reporting may clarify CVE mechanics, affected configurations and whether exploitation occurred.
Key Questions
What is confirmed, and what remains open in the available account?
What is PHP2Shell?
The source account’s name for two critical RCE flaws patched on October 21, 2026: CVE-2026-109618 and CVE-2026-109619.
Which versions include the fixes?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Operators should use the release matching their branch.
Who is credited with the research?
Calif, OpenAI and Wiz. Separate timelines are provided for Calif and Wiz, but the material does not map groups to individual CVEs.
Were the flaws exploited before patching?
The supplied material does not say whether attackers exploited either vulnerability before disclosure.
Are the 2026 flaws the same as the 2004 issue?
Calif frames the work within a longer history. The available details do not establish that the 2004, 2019 and 2026 issues share a root cause.
What did Wiz report?
Wiz said it found a separate PHP flaw between August 19 and 24, using Wiz Atlas with Gemini 4 Argon and GPT-5.6 Sol. It reported RCE confirmation on Drupal and WordPress.
Why PHP Runtime Fixes Matter
Remote code execution can let an attacker run code on a vulnerable server, making these flaws a serious concern for organizations operating affected PHP versions. PHP’s presence in web applications means administrators need to identify their deployed branch and apply the corresponding release. The two vulnerabilities’ CVSS v4.0 score of 9.2 signals high severity, but the score alone does not establish how widely the flaws were exploited.
The account also points to a practical lesson in security research: an issue first observed as a reliability or denial-of-service problem can warrant renewed examination as researchers learn more about its behavior. Calif’s narrative connects the 2026 work to older reports, but the available source does not establish that the 2004, 2019 and 2026 bugs are the same vulnerability. The confirmed development is the release of two new fixes; the historical connection is Calif’s framing of the research.
As an affiliate, we earn on qualifying purchases.
From Memory Limits to New CVEs
In July 2004, e-matters published Advisory 11/2004, attributed to Stefan Esser, about PHP’s memory_limit behavior. The advisory said a remote attacker could cause request termination “in places where an interruption is unsafe.” PHP fixed the specific paths described then, according to the source account.
On Nov. 28, 2019, PHP bug #78876 reported that long multipart form fields could trigger an out-of-memory condition and leave temporary files behind. PHP fixed that issue in May 2020 as CVE-2019-11048; the stated impact at the time was denial of service. In 2024, Quarkslab audited PHP with OSTIF and the PHP Foundation. Calif says the audit rediscovered the out-of-memory issue, but exploitation was not demonstrated and the bug remained open. OSTIF’s published summary, as described in the supplied material, does not mention that issue.
Calif joined OpenAI’s Patch the Planet program on July 30, 2026, and selected PHP. Calif’s account says Stefan Esser connected the effort with the PHP Foundation through Volker Dusch. Calif reported its findings during August; Wiz reported its finding later that month. PHP issued the four patched releases on Oct. 21.
““possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe.””
— Stefan Esser, e-matters Advisory 11/2004
web application vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What the Timeline Cannot Establish
The supplied material does not specify which CVE corresponds to each research group, provide a full technical description of both flaws, or say whether attackers exploited them before disclosure. It also does not give a confirmed count of affected installations or identify all vulnerable configurations.
The historical account should be read with care. Calif connects the new research to a class of problems involving memory-limit interruptions, but the available details do not prove that the 2004 advisory, CVE-2019-11048 and the 2026 vulnerabilities share the same root cause. The 2024 audit account is also attributed to Calif; the cited OSTIF summary, according to the source material, does not describe the out-of-memory finding.
remote code execution prevention tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Apply the Matching PHP Release
Administrators should check which PHP branch their systems run and update to the matching patched release: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. They should also check application and hosting deployments where PHP versions may be managed separately. The source material does not provide a later milestone or say when additional technical details will be published.
Further reporting may clarify the individual CVE mechanics, affected configurations and whether exploitation occurred before the fixes. Until those details are available, the confirmed next step for operators is to install the patch that matches their supported PHP branch.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used in the source account for two critical remote code execution flaws patched by PHP on Oct. 21, 2026: CVE-2026-109618 and CVE-2026-109619.
Which PHP versions include the fixes?
The listed patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Operators should match the update to the PHP branch they use.
Who is credited with finding the vulnerabilities?
The research is credited to Calif, OpenAI and Wiz. The supplied material gives separate timelines for Calif and Wiz, but does not assign each research group to a particular CVE.
Were the flaws exploited before PHP released the patches?
The source material does not say whether attackers exploited either flaw before disclosure. That remains unclear.
Are the 2026 flaws the same as the 2004 issue?
Calif frames the research as part of a longer history of unsafe interruptions and memory-limit behavior. The available details do not establish that the 2026 vulnerabilities are the same underlying bug as the 2004 advisory or the 2019 issue.
Source: Thorsten Meyer AI
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
