Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Fact · discovery · confirmed
The GitHub advisories credit four reporters: lcfr-hax (Calif), sagitzadik-wiz (Wiz), amyb-oai (OpenAI) and tomash-areion
tomash-areion is not named in the PHP Foundation's thanks and appears nowhere else on this beat.
Fact-check
A6 Established●●●●●● · Record · verdict: holds
Both captured GitHub advisories list exactly these four handles as 'Reporter' (A6, the record itself). The affiliations in brackets are inferred from handle suffixes and other pages (Calif's '@lcfr_hax', Wiz author Sagi Tzadik, the Foundation's thanks to Amy Burnett of OpenAI Codex Security), not stated by the advisories.
| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| github-ghsa-w8hw-w9fx-j79w | carries | Credits lcfr-hax Reporter sagitzadik-wiz Reporter tomash-areion Reporter amyb-oai Reporter | 84ab95d3b1d538ba |
| github-ghsa-6wmf-4rv5-p3rp | carries | Credits sagitzadik-wiz Reporter tomash-areion Reporter lcfr-hax Reporter amyb-oai Reporter | 99d85c973c41c024 |
| daubois-blog-php2shell-rumors | carries | Advisory opened: 2026-08-27, credited to lcfr-hax, sagitzadik-wiz, amyb-oai and tomash-areion | 5ef17f9886aa93f7 |
| cve-cve-2026-109618 | partial | Ryan at Calif.io reporter Wiz reporter OpenAI finder | f8705d8e0aa2a248 |
| cve-cve-2026-109619 | partial | Wiz reporter Ryan at Calif.io reporter OpenAI reporter | 3162135e82a9edd4 |
Open tickets: Finding-73.
Graded in Run-1, resting on captures up to 2026-10-22 08:12 UTC. The scale is on the fact-check page.
This fact over time
- 2026-10-21Daubois publishes What the PHP2Shell rumors got wrong, from inside the PHP security team
- 2026-10-21 13:34 UTCPHP publishes RCE via OOM corruption (CVE-2026-109618)
- 2026-10-21 13:34 UTCPHP publishes RCE via stale global state (CVE-2026-109619)
- 2026-10-22 08:09 UTCSaved into the evidence vault: PHP
- 2026-10-22 08:09 UTCSaved into the evidence vault: PHP
- 2026-10-22 08:12 UTCSaved into the evidence vault: Daubois
- 2026-10-22Enters this site as confirmed in v0.1.0 (reconstructed from git)
Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.
What it rests on
Where this fact appears
In the briefings for:
And on every claim.
Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · confirmed
The GitHub advisories credit four reporters: lcfr-hax (Calif), sagitzadik-wiz (Wiz), amyb-oai (OpenAI) and tomash-areion Who says it: GitHub security advisories Status: confirmed Topic: discovery Sources: github-ghsa-w8hw-w9fx-j79w, github-ghsa-6wmf-4rv5-p3rp, daubois-blog-php2shell-rumors