php2shell by Calif Research

php2shell is a research write-up published by Calif Research that documents two PHP remote vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The flaws were discovered together with OpenAI and Wiz and were addressed in the PHP October 2026 Security Release. The page is an article, not a software product or service.

The core of the piece is a historical narrative. It begins with Stefan Esser’s 2004 discovery of the original memory-limit remote code execution issue, then moves through later PHP attack-surface research up to the 2026 findings. This timeline format helps readers understand how the new bugs relate to older exploitation techniques.

The write-up is aimed at PHP developers, application security engineers, and vulnerability researchers who need technical detail on the CVEs. Readers looking for a quick patch note may find the storytelling approach slower, but it provides useful context on root causes and exploitation paths.

For practical use, read the write-up section for the vulnerability details and confirm your PHP version against the October 2026 security release. Treat the page as reference material and verify patch status through official PHP channels before acting. Overall, it is a focused research article for security-minded PHP practitioners.