Briefing · Analyst or advisor · from the same 70 claims, selected and ordered for one reader
How did coordinated disclosure fail, and what does AI-assisted discovery change?
What this incident says about coordinated disclosure once models can find bugs, and once a leak can become a proof of concept faster than a patch can ship. The claims below are the evidence; the reading is the site's.
What to decide or do
- The window between leak and release was 22.5 hours and the window between first honeypot hit and release was four days. Both are shorter than the two months the fix took.
- Three AI-assisted teams converged on a bug class seen and shelved in 2024. The constraint that failed in 2024 was proving exploitability, and that is what models now appear to lower the cost of.
- The defensive side moved early too: WAF rules 9 hours ahead, images 6 hours ahead (against the embargo), agencies within the hour. The system is faster in both directions.
- The public numbers were not produced for decision-making and should not be used for it; the one agency that counted got about 6,000 in a country of 1.9 million people.
- Agencies diverged on the hardest question, offline or not, along lines that look institutional rather than technical.
The facts this rests on
- confirmed two or more primary sources agree, or the fact was counted from a captured file
- reported one party says so, and it has not been contradicted
- disputed the sources disagree, and both readings are shown
- contradicted a primary source says otherwise
- unverified even the reporting outlet could not check it
- p/n primary sources among the n cited; a blocked capture is counted and marked
| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| Calif found the flaws first: discovery 1 August, hash commitment 5 August, report to PHP 11 August The hash tweet is dated 5 August 2026 on X; its pre-image has not been published, so what it commits to cannot be checked. | Calif; PHP Foundation (report date) | confirmed | 3/3 | Calif Ryan Austin , Calif on X PHP Foundation |
| The GitHub advisories credit four reporters: lcfr-hax (Calif), sagitzadik-wiz (Wiz), amyb-oai (OpenAI) and tomash-areion tomash-areion is not named in the PHP Foundation's thanks and appears nowhere else on this beat. | GitHub security advisories | confirmed | 2/3 | PHP PHP Daubois |
| The out-of-memory issue was found in a 2024 audit by Quarkslab (funded through OSTIF and the Sovereign Tech Agency) but exploitation was not proven, so it was not fixed Two parties agree. The Foundation calls the delay 'a structural failure'. Cloudflare lists Quarkslab among the 2026 disclosers; nobody else does. | PHP Foundation; Calif | confirmed | 2/2 | PHP Foundation Calif |
| The flaws were found by researchers using frontier AI under OpenAI's Patch the Planet initiative All three research parties say AI was used. Calif: 'No special harness, or access to models that weren't generally available to everyone were used'. Calif does not name a model; Wiz names Gemini 4 Argon, GPT-5.6 Sol and Wiz Atlas; OpenAI's blog reportedly names GPT-5.6 Sol but is blocked. | BBC; OpenAI; Calif; Wiz | reported | 3/4 | BBC News OpenAI on X Calif Wiz |
| OpenAI independently reported the same root cause on 11 August, with further vectors on 18 September The GitHub advisories credit amyb-oai among four reporters. OpenAI's own post credits Calif's discovery 'using GPT-5.6 Sol' and Wiz; an X Community Note disputes OpenAI's role. | PHP Foundation | reported | 2/2 | PHP Foundation PHP |
| Wiz Research independently discovered the first flaw on 19 August and reported on 24 August Wiz's X post says 'Wiz Research uncovers' with no credit to Calif or OpenAI; the blog thanks both. | Wiz; PHP Foundation (24 August) | reported | 2/2 | Wiz PHP Foundation |
| The most severe flaws ever detected by AI Wiz's own wording is 'among the most severe vulnerabilities discovered in PHP, and arguably in software history'. OpenAI: 'one of the most impactful vulnerabilities in recent memory'. | BBC attributing Wiz | reported | 1/2 | BBC News Wiz |
| Quarkslab's published audit summary lists 27 findings, two redacted because their fixes were complex and in progress; it does not describe an out-of-memory finding The Foundation says the OOM signs were found while fixing one of the audit's findings, not in the audit report itself. | Quarkslab's blog; a Substack analysis | reported | 1/2 | Quarkslab David Lopez-Kurtz |
| Chainguard's team found the same bugs independently with an AI harness and a frontier model after a researcher warned them on the Friday before Unverified by anyone else. | Dan Lorenc, via The Register | reported | 0/1 | The Register |
| Frontier AI found the flaw ahead of attackers, giving defenders time to prepare Amazon reports an exploit attempt against a honeypot on 17 October, four days before disclosure, from an actor whose source of exploit information is unknown. | OpenAI | disputed | 1/2 | OpenAI on X THN |
| The release moved forward from 22 October 14:00 UTC to 21 October 14:00 UTC because of the leak The php.net ChangeLog still dates all four releases 22 October. Wiz's X thread still says 22 October. | PHP Foundation; php.net pre-announcement; Wiz thread ('Apply the Oct 22 security release') | confirmed | 4/4 | PHP Foundation oss-security Wiz on X php.net |
| On 20 October at about 15:00 UTC the two CVE IDs began circulating on forums and social media with a wrong release time and a wrong CVSS score; no technical details leaked Primary party. The Foundation does not say who or where. | PHP Foundation | reported | 2/2 | PHP Foundation PHP Foundation |
| The leak started with an anonymous Hacker News post citing a reliable source, which came down after screenshots spread; a screenshot of the 'PHP2Shell tool' credited to Calif.io and a short exploitation video also went up and came down Contradicts the Foundation's 'no technical details leaked' and The Hacker News's 'a proof-of-concept exploit leaked'. No copy of the post, screenshot or video is in the vault. | Alexandre Daubois (PHP security team, personal blog) | reported | 0/1 | Daubois |
| watchTowr confirmed in public that the bugs were real and posted both CVE numbers before the release | Daubois; CERT-EU lists a watchTowr X post among public reports | reported | 1/2 | Daubois CERT-EU |
| Calif mistakenly published a video around 20:00 UTC on 20 October showing its proof of concept against a number of targets; copies circulated and 'contributed to accelerated development of various PoCs' Calif's own page does not mention a leak or a deleted video; it embeds two demo videos. Whether one of them is the deleted video is unknown. | PHP Foundation | reported | 3/4 | PHP Foundation PHP Foundation BBC News Calif |
| Mitigation advice given to a few critical-infrastructure providers from about 23:00 UTC on 20 October may have leaked | PHP Foundation | reported | 1/1 | PHP Foundation |
| Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built images containing the fix Dan Lorenc (via The Register): 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors had reported exploits; Chainguard's honeypots trapped IPs; a researcher warned the company on the Friday and its team then found the bugs independently with an AI harness. No evidence published. The PHP security team found no functional exploit by release time. | PHP Foundation; Chainguard's CEO accepts the time and denies leaking | disputed | 1/3 | PHP Foundation The Register Feross Aboukhadijeh on X on X |
Counted from the repository, not from a page. Five authors; 389 files; 10,689 insertions. | php/php-src commit 3584a98bd, read from a clone | confirmed | 2/2 | php/php-src , read from a clone php-src |
| The fixes were released at 14:00 UTC on 21 October CERT-EU says 13:30 UTC; the tags and advisories are stamped 13:34 to 13:35 UTC; the GitHub release 14:06 UTC; the php.net feed entries carry 00:05 to 00:35 UTC, which are authoring times, not publication times. | php.net pre-announcement; Daubois; CERT-FR (16:00 Paris) | disputed | 7/8 | oss-security Daubois CERT-FR CERT-EU php-src PHP php-src php.net |
| The pre-announcement was published at 19:30 UTC on 20 October The php.net feed says 20:32 UTC; oss-security relayed it at 20:22:51 UTC, so it was public by then. | PHP Foundation | disputed | 3/3 | PHP Foundation oss-security php.net |
| The flaws were disclosed on 22 October 2026 Primary sources put the release at 21 October: GHSAs 13:34Z, tags 13:35Z, CVE records 13:48Z and 13:54Z, GitHub release 14:06Z. | BBC framing (UK morning coverage) | contradicted | 2/3 | BBC News php.net php-src |
| 674 products in the NCSC-NL inventory: 206 vulnerable, 46 fixed, 418 under investigation, 3 not vulnerable Counted, not quoted. NCSC-NL calls unbacked entries 'investigation leads'. | NCSC-NL, counted by this site from the file at commit cca173c64ec5 | confirmed | 1/1 | NCSC-NL |
| PHP is used by almost 70% of websites None of the three cites the survey it comes from. A share of websites using PHP is an upper bound on exposure, not a count of vulnerable systems. | Cloudflare; OpenAI ('an estimated 70%'); Wiz body text | reported | 3/3 | Cloudflare OpenAI on X Wiz |
| Something like 30 million websites could be affected No basis given. | Alan Woodward, via the BBC | reported | 0/1 | BBC News |
| PHP is exposed on about 2.6 million internet-facing hosts, of which Censys counted 1.57 million unpatched on 21 October Censys: 2.58 million hosts seen, 1.58 million reporting a version, 1.57 million not patched; nearly 3 million by 22 October. VirusTotal: 5.1 million IPs running PHP, 1.1 million announcing a version. Unit 42: 22.6 million systems that 'could be vulnerable' (via Insurance Business). Censys's own post was not found. | VulnCheck and Censys, via The Hacker News and SecurityWeek | reported | 0/2 | THN SecurityWeek |
| About 6,000 potentially affected resources in Latvia, a few hundred in the public sector Primary source, one country, says 'potentially'. | CERT.LV | reported | 1/1 | CERT.LV |
| Roughly 70% of the Internet is affected The BBC was 'unable to independently verify that figure'. Wiz's body text says 70% of websites and cites no measurement. | Wiz (headline, X post); BBC attributing Wiz | unverified | 2/3 | Wiz Wiz on X BBC News |
| CISA has not observed exploitation; neither CVE is in the Known Exploited Vulnerabilities catalog Catalog version 2026.10.21 fetched 2026-10-22T08:15Z, 1,754 entries. A point-in-time negative finding. | CISA | confirmed | 3/3 | CISA CISA CVE record |
| Amazon and Cloudflare saw sites being probed for the flaw Both companies have since said so themselves. | Alan Woodward, via the BBC; confirmed by both companies' own posts | confirmed | 2/3 | BBC News Cloudflare Amazon |
| The last PHP core RCE, CVE-2024-4577, was exploited in the wild one day after disclosure and in KEV three days after; php2shell is not in KEV after one day Counted from the captured catalog. | CISA KEV catalog; Akamai (2024) | confirmed | 3/3 | CISA CVE record Akamai Security Research |
| There is no evidence yet that hackers have exploited the flaw | Ryan Austin, Calif, on Radio 4, 08:00 BST 22 October | reported | 0/1 | BBC News |
| Reports of active exploitation exist The only agency saying so, and it does not say whose reports. | NCSC New Zealand | reported | 1/1 | NCSC New Zealand |
| An exploit attempt hit an Amazon honeypot on 17 October from an anonymisation network; proof-of-concept attempts began about 02:00 UTC on 21 October from multiple actors; after release 'PHP2Shell is now being broadly exploited in the wild' Primary party. Amazon adds: 'it's unclear if any of these attempts would have succeeded in real-world systems'. Attempts against honeypots, not compromises of victims. | Amazon (CJ Moses, AWS Security Blog) | reported | 1/2 | Amazon THN |
| Cloudflare observed attack traffic targeting its customers after the leak, with attackers mutating payloads Primary party, no volumes. | Cloudflare | reported | 1/1 | Cloudflare |
| Automated exploitation attempts were seen in Latvia; none succeeded Primary source. | CERT.LV | reported | 1/1 | CERT.LV |
| Exploit attempts across Cloudflare's network: thousands in the ten hours before announcement, tens of thousands within 45 minutes after, hundreds of thousands within two hours, millions by 22 October 01:25 UTC Primary party. Attempts, not compromises; no blocked count; 1.4 million views at capture. | Matthew Prince, Cloudflare CEO, on X | reported | 1/1 | Matthew Prince , Cloudflare CEO on |
| No traffic matching the php2shell exploit patterns was seen during Imperva's pre-disclosure monitoring A negative finding from a party that had the details under embargo. | Imperva Threat Research | reported | 1/1 | Imperva Threat Research |
| No exploitation observed on Huntress partner systems as of 20:30 UTC on 21 October; no public exploit code known to Huntress | Huntress | reported | 1/1 | Huntress |
| Criminals are using AI to 'vibe code' an attack method | unnamed researchers, via the BBC | unverified | 0/1 | BBC News |
| watchTowr sees active exploitation attempts and lists the flaws as exploited in the wild watchtowr.com returns HTTP 403 to this site's capture tool; known only from search summaries. | watchTowr | unverified | 2/2 | watchTowr watchTowr |
What is still open
- Who first leaked the CVE IDs on 20 October, and where. The PHP Foundation does not say; a PHP security team member points to an anonymous Hacker News post. No copy of that post is in the vault.
- Whether the deleted Calif video is the one now embedded on Calif's own write-up. Calif's page does not mention the leak.
- Whether any site was actually compromised before it was patched or taken offline. Every claim of exploitation so far is of attempts, probes or honeypot hits.
- Which sites were really taken offline, and why. The BBC's list (parts of Wikipedia, Edinburgh council, French government services, the University of Geneva, the BBC itself) has not been captured from any of those organisations. Latvia's geo-blocking is the one documented case, from the agency itself.
- Whether the 8.5.12 fix is complete. A Fediverse report of a third bug or incomplete fix reached oss-security on 21 October; PHP reportedly told Canonical it is unrelated. Nothing from PHP on the list yet.
The full set of claims is on every claim; the ordered steps for a vulnerable system are on if you run PHP. Other briefings: Board member or executive · Security lead · PHP or platform engineer · Journalist · Security researcher · CISO · CTO · CFO · Head of AppSec · Developer · Media and communications team.