Who Found PHP2Shell: Humans or AI?

PHP2Shell is two flaws in PHP core, CVE-2026-109618 and CVE-2026-109619, both allowing unauthenticated remote code execution. The first is memory corruption during out-of-memory handling. The second is internal state that survives a fatal error and gets reused by the next request on the same worker process.

Both were patched on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP scored them 9.2 on CVSS v4.0; the National Vulnerability Database scored the same pair 9.8 on the older v3.1 scale.

The earliest affected release Calif identified is PHP 5.4.0, which shipped on 1 March 2012. That makes the vulnerable code 14.6 years old at the point it was patched.

The slate half of the timeline is not a story of nobody looking. It is a story of people finding the right thing and being unable to finish it.

In July 2004 Stefan Esser documented CAN-2004-0594, where PHP terminated a request on hitting its memory limit at a point where internal state was unsafe, and showed that could reach code execution. That is the same weakness family, though not the same code path. Calif calls it the original memory-limit RCE.

In November 2019 bug #78876 recorded an out-of-memory crash with temporary files left behind. It was assigned its own CVE and fixed as a crash. Nobody connected it to a route to code execution.

The closest call came in 2024, when an external audit of PHP found what the PHP Foundation later described as the first signs of the out-of-memory problem behind CVE-2026-109618. An exploit was theorized. No concrete vector was found, and by the Foundation’s own account the fix stalled for want of a known path to remote code execution. That is the gap the 2026 work closed.

The pink half of the timeline is six events between 1 August and 21 October 2026, and each team has published what it used.

Calif was first, on 1 August. Its write-up describes an agent noticing an ordering problem inside a PHP hash function during a source review, then tracing the root cause to automatic nested POST parsing and finding that mod_php shutdown consumes the malformed table. OpenAI says Calif identified the flaw using GPT-5.6 Sol under its Patch the Planet initiative. Calif reported on 11 August; OpenAI independently reported the same root cause the same day.

Wiz discovered its first bug on 19 August and reported on 24 August. Its account is the most specific about tooling: Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol were used throughout, and it credits Gemini 4 Argon with contributing to finding the vulnerability, developing the exploit, detecting attacks and validating the patch. OpenAI reported further attack vectors on 18 September.

The teams differ on what the models did beyond discovery, and the difference matters. Wiz says frontier models were critical to making the process practical and let it develop and adapt working exploits across multiple applications in hours. Calif says nothing about a model writing or adapting its exploit chain. On that stage, silence is not agreement.

Calif is also the most restrained about what happened. It says no special harness and no models beyond those generally available were used in the initial discovery, that it chose a target whose vulnerability patterns it already knew, and plainly that no model is simply capable of unearthing all bugs with simple prompts, at least for now.

Three independent teams converging in three weeks is strong evidence that something changed in what is findable. It is not a measurement of how much, and it is one flaw.

The claim that would matter is that AI collapsed the cost of exploit development. Wiz puts a number on it: a single researcher completed in a week what would previously have taken a world-class team months. No source is given for the comparison, and every party making a version of this claim sells either AI or security products.

There is counter-evidence in the record too. PHP’s own CVSS v4.0 vector rates attack complexity high and marks attack requirements as present. Sansec reported on 22 October that public proof-of-concept code does not work against a default PHP installation. Whatever the models contributed, the attack did not become trivial.

What the timeline supports without stretching is narrower and still interesting: a weakness class documented in 2004 and a specific bug found in 2024 sat without a working exploit, and in August 2026 three independent teams built one within three weeks of each other, each naming the model it used.