PHP2Shell: What the 2024 warning actually covered

The PHP Foundation’s account places an early warning about the out-of-memory root cause behind CVE-2026-109618 in 2024, while a developer was addressing a finding from an external Quarkslab security audit. The account says no concrete exploit had been demonstrated then. It describes an early signal about one PHP2Shell flaw, not a demonstrated attack involving both vulnerabilities.

What the 2024 warning covered

A core developer noticed early signs of an out-of-memory (OOM) memory-handling problem while working through the audit finding. OOM errors occur when a program cannot allocate the memory it needs. The issue later became associated with CVE-2026-109618, one of the two PHP core vulnerabilities collectively called PHP2Shell; the other is CVE-2026-109619.

That distinction matters to the timeline: noticing a possible root cause was not the same as demonstrating a working remote-code-execution exploit. The Foundation’s account says no concrete exploit had been shown in 2024.

Why the fix took time

The PHP Foundation attributed months of delay to both engineering trade-offs and organizational constraints. Proposed fixes risked backward-compatibility problems, denial-of-service issues, or conflicts with third-party extensions. The Foundation also cited its decision-making process and limited resources.

Those costs help explain why recognizing a flaw did not immediately produce a fix. A change intended to close a memory-handling vulnerability could also disrupt existing software or introduce another reliability problem, so maintainers had to weigh competing risks.

How later reports unfolded

The 2026 sequence involved several researchers and organizations, rather than one AI model discovering both vulnerabilities on its own. Calif researcher Ryan Austin reported a remote-code-execution finding on August 11. OpenAI independently reported the same root cause that day. Wiz Research reported its findings to the PHP security team on August 24, and the PHP Foundation’s account says OpenAI submitted further attack vectors on September 18.

PHP’s fixed releases arrived on October 21, 2026. NeoTeo’s earlier coverage of PHP2Shell and CISA’s KEV listing covers the later agency response and operator measures.