php2shell: A 20-Year Deep Dive Into Two PHP Remote Vulnerabilities
moyix · x · 2026-10-21
Calif, OpenAI and Wiz jointly discovered two PHP remote vulnerabilities (CVE-2026-109618 / CVE-2026-109619), fixed in PHP's October 2026 security release. The write-up is structured as a journey through time: starting from Stefan Esser's 2004 discovery of the first PHP memory-limit RCE — critical enough that he never published his exploit, while commercial vendors CORE and Immunity held private ones — then covering the 2008 call-time-pass-by-reference/interruption bugs, the unserialize() use-after-free and POP-chain era, and a seemingly harmless OOM bug (#78876) reported in 2020, all leading to the two new remotely exploitable flaws. The team's earlier sweep of legacy PHP bugs had found no default-exploitable vectors, making this a deeper second pass.
Related event: PHP Patches Two Critical Unauthenticated RCE Flaws Across Four Releases(26 posts)→
More from Research
- EAU: Co-evolving user simulator, environment, and RL setup for training LLM agents — UAlberta · 2026-10-21
- Meta's Self-Credit: Dense Rewards from Sparse RLVR via Intra-group Rescaling — meta · 2026-10-21
- New paper: game-theoretic limits of being helpful yet harmless when an AI assistant doesn't know who it's talking to — conitzer · 2026-10-21
- CS1: a 4B clinical decision model trained on 12.4M questions beats open rivals — AI4Pathology · 2026-10-21
- DeepMind team makes new discoveries on the 6th Busy Beaver number, shares resources — TZahavy · 2026-10-21
- AI takes on longer research tasks, but choosing the right question remains hard — nathanbenaich · 2026-10-21