# Fact: The GitHub advisories credit four reporters: lcfr-hax (Calif), sagitzadik-wiz (W

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

The GitHub advisories credit four reporters: lcfr-hax (Calif), sagitzadik-wiz (Wiz), amyb-oai (OpenAI) and tomash-areion Who says it, its status (confirmed), its sources, and its timeline from publication to this site.

Fact · discovery · confirmed

# The GitHub advisories credit four reporters: lcfr-hax (Calif), sagitzadik-wiz (Wiz), amyb-oai (OpenAI) and tomash-areion

**Who says it:** GitHub security advisories · **Sources:** [PHP](../../sources/github-ghsa-w8hw-w9fx-j79w/index.html) [PHP](../../sources/github-ghsa-6wmf-4rv5-p3rp/index.html) [Daubois](../../sources/daubois-blog-php2shell-rumors/index.html)

tomash-areion is not named in the PHP Foundation's thanks and appears nowhere else on this beat.

## Fact-check

**A6** Established●●●●●● · Record · verdict: **holds**

Both captured GitHub advisories list exactly these four handles as 'Reporter' (A6, the record itself). The affiliations in brackets are inferred from handle suffixes and other pages (Calif's '@lcfr_hax', Wiz author Sagi Tzadik, the Foundation's thanks to Amy Burnett of OpenAI Codex Security), not stated by the advisories.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [github-ghsa-w8hw-w9fx-j79w](../../sources/github-ghsa-w8hw-w9fx-j79w/index.html) | carries | *Credits lcfr-hax Reporter sagitzadik-wiz Reporter tomash-areion Reporter amyb-oai Reporter* | 84ab95d3b1d538ba |
| [github-ghsa-6wmf-4rv5-p3rp](../../sources/github-ghsa-6wmf-4rv5-p3rp/index.html) | carries | *Credits sagitzadik-wiz Reporter tomash-areion Reporter lcfr-hax Reporter amyb-oai Reporter* | 99d85c973c41c024 |
| [daubois-blog-php2shell-rumors](../../sources/daubois-blog-php2shell-rumors/index.html) | carries | *Advisory opened: 2026-08-27, credited to lcfr-hax, sagitzadik-wiz, amyb-oai and tomash-areion* | 5ef17f9886aa93f7 |
| [cve-cve-2026-109618](../../sources/cve-cve-2026-109618/index.html) | partial | *Ryan at Calif.io reporter Wiz reporter OpenAI finder* | f8705d8e0aa2a248 |
| [cve-cve-2026-109619](../../sources/cve-cve-2026-109619/index.html) | partial | *Wiz reporter Ryan at Calif.io reporter OpenAI reporter* | 3162135e82a9edd4 |

Open tickets: [Finding-73](../../factcheck/index.html#Finding-73).

Graded in Run-1, resting on captures up to 2026-10-22 08:12 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-21Daubois publishes [What the PHP2Shell rumors got wrong, from inside the PHP security team](../../sources/daubois-blog-php2shell-rumors/index.html)
- 2026-10-21 13:34 UTCPHP publishes [RCE via OOM corruption (CVE-2026-109618)](../../sources/github-ghsa-w8hw-w9fx-j79w/index.html)
- 2026-10-21 13:34 UTCPHP publishes [RCE via stale global state (CVE-2026-109619)](../../sources/github-ghsa-6wmf-4rv5-p3rp/index.html)
- 2026-10-22 08:09 UTCSaved into the evidence vault: PHP
- 2026-10-22 08:09 UTCSaved into the evidence vault: PHP
- 2026-10-22 08:12 UTCSaved into the evidence vault: Daubois
- 2026-10-22Enters this site as confirmed in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
RRowanJournalistAAshSecurity researcherBBlakeAnalyst or policy advisorRRileyCommunications team
And on [every claim](../../claims/index.html#four-reporters).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · confirmed
```
The GitHub advisories credit four reporters: lcfr-hax (Calif), sagitzadik-wiz (Wiz), amyb-oai (OpenAI) and tomash-areion
Who says it: GitHub security advisories
Status: confirmed
Topic: discovery
Sources: github-ghsa-w8hw-w9fx-j79w, github-ghsa-6wmf-4rv5-p3rp, daubois-blog-php2shell-rumors
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/four-reporters/index.html