TL;DR
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
PHP released fixes on October 21, 2026, for two remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS 4.0. Calif, OpenAI and Wiz are credited with research; the account traces one line of investigation to a 2004 warning about unsafe memory limit interruptions.
PHP released fixes on October 21, 2026 for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 under CVSS 4.0. Research credited to Calif, OpenAI and Wiz brought attention to flaws in the widely used runtime, while the account of the work links one line of investigation to a 2004 advisory about unsafe interruptions when PHP enforces memory limits.
The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP’s security advisory disclosed both CVEs on the same day the fixes were released. The supplied account describes multiple remote code execution paths found by Calif and a separate PHP flaw found by Wiz. It says Calif first reported a flaw on August 11, 2026, produced a working proof of concept on August 14, and received PHP’s confirmation on August 15; Calif reported a second issue on August 21.
Wiz Research reported its finding on August 24. The source says Wiz used its Atlas platform with Gemini 4 Argon and GPT-5.6 Sol, and that remote code execution was confirmed on Drupal and WordPress. Those details are attributed to the research accounts; the supplied material does not include independent technical documentation to assess the demonstrations.
The historical thread centers on what can happen when PHP’s memory limit interrupts execution during an unsafe operation. A 2019 bug report documented long multipart form fields triggering an out-of-memory condition and leaving temporary files behind. PHP fixed that issue in 2020 as a denial-of-service vulnerability, CVE-2019-11048. Calif says the issue was encountered again during a 2024 audit, but exploitation was not proven then. The 2026 vulnerabilities were addressed in the new releases.
Security briefing · PHP runtime · October 2026
22 Years In The Making: Revisiting PHP2Shell With AI-Assisted Review
PHP released fixes for two critical remote code execution flaws. The research account connects the 2026 findings to a much older warning about unsafe interruptions during memory limit enforcement.
“An interruption is only safe when the runtime can leave its state consistent.”
Investigation theme · memory limit handling01 / What changed
Two critical flaws, patched across four branches
Remote code execution can allow an attacker to run code on a vulnerable server. A 9.2 score indicates severe risk, but does not by itself show whether a particular installation is exposed or has been attacked.
Remote code execution
One of two vulnerabilities disclosed with the October 21 fixes. Rated 9.2 under CVSS 4.0.
Remote code execution
A second critical flaw, also rated 9.2 under CVSS 4.0.
Fixes available
PHP shipped patched versions for maintained branches from 8.2 through 8.5.
02 / Investigation timeline
From first report to public release
The supplied account describes Calif reporting two issues and Wiz reporting a separate finding. These dates and demonstration details are attributed to the research accounts.
First report
Calif reports an initial flaw to PHP.
Proof & confirmation
Calif develops a proof of concept; PHP confirms the issue.
Second issue
Calif reports another vulnerability.
Wiz report
Wiz Research reports its separate PHP finding.
Fixes released
PHP publishes fixes and security disclosures.
03 / The longer thread
A history of interruption, memory limits, and follow-up
Memory limit termination
Stefan Esser of e-matters warned that a remote attacker might trigger memory limit termination “in places where an interruption is unsafe.” PHP fixed the specific paths described at the time.
Out of memory, leftover files
A report described long multipart form fields causing an out-of-memory condition and temporary files left behind. PHP fixed the issue in 2020 as CVE-2019-11048, a denial-of-service flaw.
Rediscovered, not proven
Quarkslab audited PHP with OSTIF and the PHP Foundation. Calif says the issue surfaced again, but exploitation was not proven at that time.
New findings addressed
Calif joined OpenAI’s Patch the Planet program in July and selected PHP for research. The supplied account says Wiz used Atlas with Gemini 4 Argon and GPT-5.6 Sol, and confirmed execution on Drupal and WordPress.
04 / Operator action
Check your branch. Apply the matching fix.
Identify the PHP branch used by each service, then update to the corresponding patched release listed in the source account.
- Inventory PHP services and record the running branch.
- Apply the appropriate fixed release through your normal deployment process.
- Restart services as needed and verify the running version.
- Review official advisories and research write-ups as details develop.
05 / What is known—and open
Separate the reported research from confirmed exposure
Who is credited?
The account credits Calif, OpenAI, and Wiz researchers. PHP’s security team released the fixes.
Were attacks seen in the wild?
The supplied material does not say whether either CVE was exploited in real-world attacks.
How many systems remain exposed?
No deployment count or estimate of unpatched systems is provided.
Are the historical issues identical?
The account links a class of unsafe interruption behavior across investigations; it does not establish one unchanged vulnerability from 2004 to 2026.
Traceability / The research narrative
One question carried across two decades
Unsafe interruption warning
Memory limit termination can interrupt execution in unsafe places.
Memory exhaustion report
Multipart input leaves temporary files after an out-of-memory condition.
Audit rediscovery
Related behavior revisited; exploitation not proven, according to Calif.
Research findings
Researchers report RCE paths and a separate PHP flaw.
Upgrade & verify
Move services to the fixed release for their supported branch.
Why PHP Runtime Patches Matter
Remote code execution flaws can let an attacker run code on a vulnerable server, making patching relevant to organizations that host PHP applications. The affected runtime supports a large web ecosystem; the source specifically points to Drupal and WordPress as environments where Wiz confirmed execution. The CVSS 4.0 rating of 9.2 for each CVE signals severe risk, though a score alone does not establish that a particular installation is exposed or has been attacked.
The timeline also shows why older reports and audit findings can matter. A memory exhaustion issue first treated as a denial-of-service problem raised a further question about what state PHP might leave behind when interrupted. The source describes research that revisited that behavior and found paths with more serious consequences. This does not mean the 2004 issue remained unpatched in its original form; it means the account traces a related class of unsafe interruption behavior across later investigations.
For administrators, the practical development is the availability of patched versions across four maintained PHP branches. Systems running PHP should be checked against the advisory and updated to a fixed release appropriate to their branch. The source points readers to a separate patch and restart guide, but does not provide deployment counts or evidence about the number of systems still vulnerable.
PHP security vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From Memory Limits to PHP2Shell
In July 2004, Stefan Esser of e-matters published Advisory 11/2004, titled “PHP memory_limit remote vulnerability.” The advisory said a remote attacker could trigger memory limit termination “in places where an interruption is unsafe,” potentially allowing code execution on remote PHP servers. PHP fixed the specific paths described at the time. The 2026 account presents that advisory as an early warning about a broader class of problems, rather than proof that the same 2004 vulnerability persisted unchanged.
PHP bug #78876 was filed on November 28, 2019. It described long variables in multipart form data causing an out-of-memory condition and temporary files not being cleaned up. The bug was fixed in May 2020 and assigned CVE-2019-11048, which the source characterizes as a denial-of-service issue because residual files could fill a disk.
In 2024, Quarkslab conducted a PHP audit with OSTIF and the PHP Foundation. OSTIF’s published summary lists 27 findings and four CVEs, all resolved; its summary does not mention an out-of-memory issue. Calif’s account says auditors rediscovered the issue but did not prove exploitation, so it remained open at that point. Calif later joined OpenAI’s Patch the Planet program in July 2026 and selected PHP for research.
““possible for a remote attacker to trigger the memory_limit request termination in places where an interruption is unsafe””
— Stefan Esser, e-matters Advisory 11/2004
web application security testing tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Open Questions on Exposure
The supplied material does not state how many PHP deployments remain unpatched, whether attackers have exploited either CVE, or whether PHP has observed attacks in the wild. It also does not provide the full technical details needed to compare the two vulnerabilities or identify every configuration and application affected. Those points should be checked against PHP’s advisories and the researchers’ technical write-ups.
The account attributes the 2024 rediscovery and the August 2026 research timeline to Calif, and describes Wiz’s testing results. It does not reproduce the underlying audit records, proof-of-concept details or full PHP advisory text. The relationship between the 2004, 2019 and 2026 issues is presented as a research narrative about a class of failure; the source does not establish that they are one unchanged vulnerability.
remote code execution vulnerability patch
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Patch Supported PHP Branches
Operators should identify the PHP branch used by each service and apply the corresponding fixed release: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, as applicable. They should then follow their normal deployment process to restart services and verify the running version. The source material gives no deadline beyond the October 21 release, so organizations should consult PHP’s security advisory for current guidance.
Further technical details may clarify the affected code paths, prerequisites and any observed exploitation. The available account does not provide a date for additional disclosures or say whether researchers or PHP plan further updates. For now, the confirmed next step is deployment of the fixes and review of official advisories as information develops.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did PHP announce?
PHP released patches on October 21, 2026, for two remote code execution flaws: CVE-2026-109618 and CVE-2026-109619. Both received a CVSS 4.0 rating of 9.2.
Which PHP versions contain the fixes?
The releases listed in the source are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Administrators should confirm the right release for their branch against PHP’s advisory.
Who is credited with finding the vulnerabilities?
The source credits research groups Calif, OpenAI and Wiz. It describes Calif reporting two bugs and Wiz reporting a separate finding; the PHP security team released the fixes.
Were the 2026 vulnerabilities exploited in attacks?
The supplied material does not say whether either vulnerability was exploited in the wild. It describes research demonstrations, including Wiz’s reported confirmation on Drupal and WordPress, which is distinct from evidence of real-world attacks.
Source: Thorsten Meyer AI
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
