Calif describes researcher-guided LLM investigation of PHP memory-limit failures and stale interpreter state. A fatal error can interrupt initialization or cleanup, leaving memory that a later teardown or request incorrectly trusts. Exploitability depends on the affected path, SAPI and application. The researchers report working demonstrations; this review…
Inspect the ClaimsCase · DiggingBeagle record
AI-assisted PHP research exposed request-cleanup paths to remote code execution
Scope
Two PHP vulnerabilities, research demonstrations and separately observed honeypot attempts; not a measured population of compromised production sites.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- observed live
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- WITH AI
Basis and provenance
CLM-PHP2SHELL-AI-DISCOVERY-1 reports: Calif reports that an LLM helped identify memory-pressure triggers and trace an incompletely initialized structure into request shutdown; human knowledge of earlier PHP bugs guided the investigation. Source SRC-2026-CP17-CALIF-PHP2SHELL is located at 'You said OOM-fatal?; But what does an OOM buy you, really?; How did we find this?'. The distinctive mechanism begins: Research groups used AI-assisted analysis to revisit PHP engine error and shutdown handling, not to attack a chatbot. Classification: setting=production, exploit_status=observed_live, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=patch_available; scoped control or limit: Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 as applicable, and treat WAF rules as an interim measure with imperfect coverage. The technical defect is in the PHP runtime, so fixing an application-level prompt or form cannot address the interpreter's cleanup state. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.
Assessed Oct 23, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-PHP2SHELL-AI-DISCOVERY-1 · CLM-PHP2SHELL-AI-DISCOVERY-2 · CLM-PHP2SHELL-AI-DISCOVERY-3 · CLM-PHP2SHELL-AI-DISCOVERY-4 · Calif: PHP2Shell technical discovery and reproduction · PHP Foundation: October 21 security release · AWS: PHP2Shell attempts before public disclosure
At a glance
No independent exploit rerun; pre-disclosure attacker knowledge and successful production exploitation remain unestablished here.
Limits and uncertaintyFull account
Calif describes researcher-guided LLM investigation of PHP memory-limit failures and stale interpreter state. A fatal error can interrupt initialization or cleanup, leaving memory that a later teardown or request incorrectly trusts. Exploitability depends on the affected path, SAPI and application. The researchers report working demonstrations; this review did not execute them. Technical account.
Mechanism, preconditions and effects. Research groups used AI-assisted analysis to revisit PHP engine error and shutdown handling, not to attack a chatbot. Calif's account traces out-of-memory failure and partially initialized interpreter state through cleanup; other reports show a related stale global-state path. Wiz describes reproduction on multiple common PHP-backed applications. PHP's October 21 fixed releases cover CVE-2026-109618 and CVE-2026-109619, while AWS reports a honeypot attempt on October 17 before the public release.
Comparison and evidence limits. Observed request traffic and WAF attempts are not a count of compromised production sites; disabling a service as a precaution is not evidence that it was penetrated. The vulnerabilities share a PHP engine boundary but are two CVEs, and researchers' independent discoveries must retain separate attribution. The source material does not establish that AI alone found every attack step or that an LLM autonomously selected any production targets.
Timeline
- Oct 21, 2026disclosure
Public disclosure
Claims & evidence
CLM-PHP2SHELL-AI-DISCOVERY-1Calif reports that an LLM helped identify memory-pressure triggers and trace an incompletely initialized structure into request shutdown; human knowledge of earlier PHP bugs guided the investigation.supported
Basis: reported finding
- supportsCalif: PHP2Shell technical discovery and reproductionprimary disclosure
You said OOM-fatal?; But what does an OOM buy you, really?; How did we find this?
CLM-PHP2SHELL-AI-DISCOVERY-2PHP released fixes for CVE-2026-109618 and CVE-2026-109619 on October 21 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.supported
Basis: reported finding
- supportsPHP Foundation: October 21 security releasevendor statement
Today's PHP security release; vulnerability and fixed-version summary
CLM-PHP2SHELL-AI-DISCOVERY-3AWS recorded a PHP2Shell attempt in MadPot on October 17, before public disclosure; it does not establish how the actor learned the flaw or whether attempts would succeed on real systems.supported
Basis: reported finding
- supportsAWS: PHP2Shell attempts before public disclosureprimary disclosure
Opening paragraphs and October 21 02:00-08:00 UTC telemetry discussion
CLM-PHP2SHELL-AI-DISCOVERY-4PHP Foundation credits OpenAI with independently reporting the same OOM root cause and subsequently providing additional attack vectors.supported
Basis: reported finding
- supportsPHP Foundation: October 21 security releasevendor statement
Audit chronology, paragraphs on Calif, OpenAI and Wiz; inspected lines31-32
Controls and mitigations
- Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 as applicable, and treat WAF rules as an interim measure with imperfect coverage. The technical defect is in the PHP runtime, so fixing an application-level prompt or form cannot address the interpreter's cleanup state.
Unknowns and contradictions
- No independent exploit rerun; pre-disclosure attacker knowledge and successful production exploitation remain unestablished here.
Sources and citation
Material revision history
- Oct 23, 2026 · Canonical change recorded · new in release · revision 183