PHP had released fixes for PHP2Shell before IEEE Spectrum published its November 2, 2026 analysis. The security story now is what the discovery reveals: expert researchers used AI tools to develop a known memory-error condition into a way to execute code on a server, while repairing the underlying software required months of engineering.
The findings came from a PHP audit by security company Calif, sponsored by OpenAI, with Wiz confirming and expanding the research. The vulnerabilities were disclosed on October 21, alongside a PHP security release. PHP2Shell covers two identifiers, CVE-2026-109618 and CVE-2026-109619, encompassing several related memory-safety problems. (IEEE Spectrum, Calif)
For administrators, the immediate action is straightforward: install the relevant PHP security updates. For maintainers, the harder lesson concerns old crash reports. A bug that previously seemed too difficult to exploit may deserve another look when AI can help researchers work through its complicated consequences.
A Crash Report Was Only the Starting Point
Calif’s account gives the problem a longer history than the 2024 report highlighted by Spectrum. According to its technical write-up, a 2020 PHP bug report described an out-of-memory condition and temporary files that were not properly cleaned up. An OSTIF and Quarkslab audit revisited the issue in 2024, but exploitation was not demonstrated and the bug remained unfixed.
Calif dates the start of its OpenAI-backed project to July 30, 2026, and its first critical discovery to August 1. The researchers subsequently found additional paths and developed exploits against different PHP deployment configurations. (Calif)
That chronology changes how to interpret the AI contribution. AI did not simply discover an unknown flaw in untouched code. Researchers investigated a known failure mode and established that its consequences were much worse than a crash.
The technical distinction matters. PHP’s memory_limit controls how much memory a script may allocate. Exceeding that limit can trigger a fatal error that interrupts execution. An out-of-memory failure is not, by itself, proof that an attacker can execute code.
The dangerous behavior described by Calif occurs during interruption and cleanup:
- A fatal error interrupts native PHP code. Execution stops before that code completes its normal cleanup.
- Internal state survives in an inconsistent condition. Some references can remain even though the operation that created them did not finish.
- Request shutdown frees memory. Surviving state may still point to those freed allocations.
- Stale references become an exploitation opportunity. Under the right conditions, accessing freed or reused memory can expose data or enable memory corruption.
This is a use-after-free problem: software continues using memory after its ownership or lifetime has ended. The failure concerns PHP’s native implementation, so secure application code alone cannot remove it. (Calif, Wiz)
My reading is that the neglected signal here was incomplete cleanup, not merely a dramatic crash. A crash report involving stale state or interrupted resource handling deserves security attention even before someone supplies a working exploit. PHP2Shell shows why waiting for that demonstration can leave a dangerous issue unresolved for years.
What AI Contributed to the Exploit
Calif describes asking an AI model for help finding ways to trigger controllable memory-limit failures. One useful finding concerned getting past the smaller post_max_size barrier that would ordinarily prevent a request from creating enough memory pressure to reach memory_limit.
That was one component of a larger research problem. The team also needed interruption points that left usable stale state, ways to disclose memory, and exploit chains adapted to particular applications and server configurations. Calif reports successful exploitation involving both mod_php, which integrates PHP into Apache, and PHP-FPM, a separate process manager commonly used to serve PHP applications. (Calif)
Columbia University computer scientist Suman Jana told Spectrum that the work still demanded deep security and PHP expertise. He described the difficult part as:
“It’s just that it’s a lot of very specific reasoning that is painful to do.”
Wiz similarly says frontier models helped its researchers develop and adapt working exploits across multiple applications in hours. That is a participant’s account, not an independent benchmark of AI performance. The published evidence does not provide a controlled comparison using the same researchers, targets and time budgets with and without AI. (Wiz)
The supported conclusion is narrower, but still important: AI helped experts connect complicated pieces that had previously prevented a known bug from becoming a demonstrated exploit.
I would treat that as a change in vulnerability triage. “Exploitation looks complicated” is a weaker reason to postpone investigation when tools can reduce the reasoning cost. This case does not show that inexperienced attackers can reproduce every such result, or establish how quickly future vulnerabilities will emerge.
Why Fixing the Bug Took Longer
Spectrum reports that the patch required four engineers working for two months. Its account describes a researcher reaching an arbitrary-code-execution path within two weeks of the audit. Calif’s timeline places the first critical discovery just days after work began. Those milestones describe different stages of the investigation, so they should not be converted into a neat discovery-versus-patching speed ratio. (IEEE Spectrum, Calif)
They nevertheless reveal a practical asymmetry.
An exploit needs one reliable path through the software into an unsafe state. A repair must close that path without breaking legitimate behavior, and maintainers must investigate related paths that could fail for the same reason. Wiz describes several exploitable instances grouped under the two CVEs and ties them to long-standing architectural decisions in PHP’s fatal-error handling. (Wiz)
PHP’s deployment diversity makes that work consequential. Application behavior, PHP versions and server interfaces affect the available exploitation paths. Calif says the earliest affected path it found dates to PHP 5.4.0; that is not a claim that every version and configuration uses an identical exploit.
There is also a second clock after maintainers release a fix: deployment. Hosting providers and administrators must identify affected installations, obtain suitable packages and replace the vulnerable running software.
The practical implication is that patch-production speed and patch-deployment speed are separate security problems. AI-assisted research can increase pressure on both. A project may coordinate disclosure successfully while customers remain exposed because their production runtime has not been updated.
The Runtime Matters More Than the CMS Label
Calif reports demonstrated pre-authentication remote code execution against applications including WordPress, Drupal, Joomla, MediaWiki, Roundcube and Nextcloud. “Pre-authentication” means those demonstrated attacks did not require an attacker to log in first. Wiz also reports application-independent disclosure of PHP worker memory, which could contain credentials, tokens or other sensitive data. (Calif, Wiz)
Those examples identify demonstrated targets, not a complete inventory of exposed websites. The underlying flaws sit in PHP itself.
Frequently Asked Questions
3 questions
1Is Updating WordPress Enough to Fix PHP2Shell?
Not necessarily. PHP2Shell affects the PHP engine beneath the application. Confirm that the server’s PHP runtime has received the relevant security fixes, alongside normal CMS updates.
