Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Fact · discovery · reported
The flaws were found by researchers using frontier AI under OpenAI's Patch the Planet initiative
All three research parties say AI was used. Calif: 'No special harness, or access to models that weren't generally available to everyone were used'. Calif does not name a model; Wiz names Gemini 4 Argon, GPT-5.6 Sol and Wiz Atlas; OpenAI's blog reportedly names GPT-5.6 Sol but is blocked.
Fact-check
A3 Echoed●●●○○○ opinion measures differently · Opinion · verdict: holds in part
That AI was used is said by each research party in its own capture (Calif, Wiz, OpenAI), but 'found by researchers using frontier AI under Patch the Planet' is a reading: Calif is the only finder shown to be under Patch the Planet, Calif never says 'frontier' and stresses generally available models, and Wiz never mentions Patch the Planet. Readings cap at A3.
| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| calif-php2shell | partial | OpenAI invited us to join its Patch the Planet initiative, and PHP stood out as a high-impact target. | 23afef81971778f9 |
| wiz-blog-php2shell | partial | we explain how frontier AI helped us find and fix vulnerabilities that had remained hidden in the PHP codebase | e3568b6f88c93f6b |
| x-openai-php2shell | carries | Patch the Planet: global response coordination as agents uncover critical vulnerabilities | 785b7cae55e3748b |
| bbc-live-ckgel5xp2xv9t | partial | The vulnerabilities were found by researchers at the security firms Calif and Wiz. | c88b8c5f4c6bc07d |
| php-foundation-blog-security-release | partial | While fixing one of the issues Quarkslab reported, a PHP core developer contracted by the PHP Foundation found the first signs of the OOM problem | a1be057adc1c5bfa |
Open tickets: Finding-1, Finding-59.
Graded in Run-1, resting on captures up to 2026-10-22 08:16 UTC. The scale is on the fact-check page.
This fact over time
- 2026-10-21Calif publishes php2shell by Calif Research — A tale of two PHP remote vulnerabilities
- 2026-10-21Wiz publishes PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
- 2026-10-21 14:04 UTCOpenAI on X publishes OpenAI on X: OpenAI models helped researchers ... discover critical security flaws in PHP
- 2026-10-22 06:16 UTCBBC News publishes PHP: Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live
- 2026-10-22 08:04 UTCSaved into the evidence vault: BBC News, then 2 more captures
- 2026-10-22 08:10 UTCSaved into the evidence vault: Calif
- 2026-10-22 08:10 UTCSaved into the evidence vault: Wiz
- 2026-10-22 08:16 UTCSaved into the evidence vault: OpenAI on X
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)
Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.
What it rests on
Where this fact appears
In the briefings for:
And on every claim.
Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
The flaws were found by researchers using frontier AI under OpenAI's Patch the Planet initiative Who says it: BBC; OpenAI; Calif; Wiz Status: reported Topic: discovery Sources: bbc-live-ckgel5xp2xv9t, x-openai-php2shell, calif-php2shell, wiz-blog-php2shell