The report
The PHP Foundation released security fixes on October 21, 2026 for two interpreter vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The Foundation notice lists corrected versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Researchers reported working remote-code-execution routes under affected conditions; the disclosures do not mean every PHP website was remotely compromised.
Calif's technical investigation describes a researcher-guided model-assisted search through out-of-memory fatal errors and incomplete PHP interpreter initialization. The failing state can reach cleanup paths that assume an object or memory region remains valid. The Foundation also credits an independent OpenAI report on the same root cause with additional follow-up attack vectors; attributing the entire discovery to one LLM would misstate that chronology.
AWS reported a MadPot honeypot attempt on October 17, before the public announcement. That observation does not establish how the actor learned about the issue, successful exploitation of real customer systems or a global victim count. Similarly, precautionary service shutdowns and elevated web-application-firewall traffic document defensive response and attempted access, not confirmed intrusion.
The durable PHP2Shell dossier separates the two CVEs, the role of AI-assisted research, affected execution paths and independent source attributions. The immediate operational boundary is the patched interpreter release and whether a deployment exposes the affected paths; source-reported attempts should not be recast as verified compromises.