Party
Calif (Ryan Austin, @lcfr_hax; Michal Zalewski)
first reporter; published the write-up with demo videos
Claims this site attributes to this party
| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| Pre-authentication RCE was confirmed against WordPress, Drupal, Joomla, MediaWiki, Roundcube, Magento, phpMyAdmin, Nextcloud, Laravel, Symfony and WHMCS Two researcher parties, no third-party reproduction in the vault. The demo videos were not downloaded. | Calif; Wiz for WordPress and Drupal | reported | 2/2 | Calif Wiz |
| The flaws were found by researchers using frontier AI under OpenAI's Patch the Planet initiative All three research parties say AI was used. Calif: 'No special harness, or access to models that weren't generally available to everyone were used'. Calif does not name a model; Wiz names Gemini 4 Argon, GPT-5.6 Sol and Wiz Atlas; OpenAI's blog reportedly names GPT-5.6 Sol but is blocked. | BBC; OpenAI; Calif; Wiz | reported | 3/4 | BBC News OpenAI on X Calif Wiz |
| Calif found the flaws first: discovery 1 August, hash commitment 5 August, report to PHP 11 August The hash tweet is dated 5 August 2026 on X; its pre-image has not been published, so what it commits to cannot be checked. | Calif; PHP Foundation (report date) | confirmed | 3/3 | Calif Ryan Austin , Calif on X PHP Foundation |
| The out-of-memory issue was found in a 2024 audit by Quarkslab (funded through OSTIF and the Sovereign Tech Agency) but exploitation was not proven, so it was not fixed Two parties agree. The Foundation calls the delay 'a structural failure'. Cloudflare lists Quarkslab among the 2026 disclosers; nobody else does. | PHP Foundation; Calif | confirmed | 2/2 | PHP Foundation Calif |
| There is no evidence yet that hackers have exploited the flaw | Ryan Austin, Calif, on Radio 4, 08:00 BST 22 October | reported | 0/1 | BBC News |
Its sources in the vault
- php2shell by Calif Research — A tale of two PHP remote vulnerabilities Calif (Calif Research)
- LCFR on X: hash commitment d935be02… Ryan Austin (@lcfr_hax), Calif