# Fact: The most severe flaws ever detected by AI

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

The most severe flaws ever detected by AI Who says it, its status (reported), its sources, and its timeline from publication to this site.

Fact · discovery · reported

# The most severe flaws ever detected by AI

**Who says it:** BBC attributing Wiz · **Sources:** [BBC News](../../sources/bbc-live-ckgel5xp2xv9t/index.html) [Wiz](../../sources/wiz-blog-php2shell/index.html)

Wiz's own wording is 'among the most severe vulnerabilities discovered in PHP, and arguably in software history'. OpenAI: 'one of the most impactful vulnerabilities in recent memory'.

## Fact-check

**A2** Reported●●○○○○ opinion measures differently · Opinion · verdict: **holds in part**

The BBC attributes to Wiz that the flaws are the 'most severe' ever detected by AI; Wiz's own blog, which the claim cites, says something narrower ('among the most severe vulnerabilities discovered in PHP, and arguably in software history'). A Substack piece relays the WSJ quoting Wiz's co-founder with close wording, so the BBC line probably traces to an interview, not the blog. A reading, held by one party, reported second-hand.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [bbc-live-ckgel5xp2xv9t](../../sources/bbc-live-ckgel5xp2xv9t/index.html) | carries | *Wiz - one of the companies whose researchers uncovered the vulnerabilities - describes the flaws as the "most severe" ever detected by AI.* | c88b8c5f4c6bc07d |
| [wiz-blog-php2shell](../../sources/wiz-blog-php2shell/index.html) | partial | *These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.* | e3568b6f88c93f6b |
| [substack-lopezkurtz-patch-is-the-exploit](../../sources/substack-lopezkurtz-patch-is-the-exploit/index.html) | partial | *Wiz’s co-founder told the Journal that PHP2Shell is “the most severe AI vulnerability that was ever found.”[40]* | cb3714dc12f96c96 |
| [cyberexpress-php2shell-gov-sites](../../sources/cyberexpress-php2shell-gov-sites/index.html) | partial | *Wiz called them the “most severe vulnerabilities ever discovered” by AI.* | f45bc7599367343e |
| [x-openai-php2shell](../../sources/x-openai-php2shell/index.html) | carries | *we consider this bug to be one of the most impactful vulnerabilities in recent memory.* | 785b7cae55e3748b |

Open tickets: [Finding-8](../../factcheck/index.html#Finding-8), [Finding-83](../../factcheck/index.html#Finding-83).

Graded in Run-1, resting on captures up to 2026-10-22 11:31 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-21Wiz publishes [PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet](../../sources/wiz-blog-php2shell/index.html)
- 2026-10-22 06:16 UTCBBC News publishes [PHP: Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live](../../sources/bbc-live-ckgel5xp2xv9t/index.html)
- 2026-10-22 08:04 UTCSaved into the evidence vault: BBC News, then 2 more captures
- 2026-10-22 08:10 UTCSaved into the evidence vault: Wiz
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
RRowanJournalistAAshSecurity researcherBBlakeAnalyst or policy advisorRRileyCommunications team
And on [every claim](../../claims/index.html#most-severe).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
```
The most severe flaws ever detected by AI
Who says it: BBC attributing Wiz
Status: reported
Topic: discovery
Sources: bbc-live-ckgel5xp2xv9t, wiz-blog-php2shell
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/most-severe/index.html