Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Fact · discovery · reported
OpenAI independently reported the same root cause on 11 August, with further vectors on 18 September
The GitHub advisories credit amyb-oai among four reporters. OpenAI's own post credits Calif's discovery 'using GPT-5.6 Sol' and Wiz; an X Community Note disputes OpenAI's role.
Fact-check
A2 Reported●●○○○○ disputed · Attribution · verdict: holds
The Foundation's page says this word for word (one named primary party, the recipient of the reports). The GHSA credits and the CVE records corroborate that OpenAI was a credited reporter or finder but carry no dates. OpenAI's own account is blocked; Cybernews relays OpenAI as saying its researcher 'subsequently' found additional flaws after Calif, and the X Community Note disputes OpenAI's discovery role.
| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| php-foundation-blog-security-release | carries | OpenAI independently reported the same root cause on the same day, followed by further attack vectors from OpenAI on September 18th | a1be057adc1c5bfa |
| github-ghsa-w8hw-w9fx-j79w | partial | amyb-oai Reporter | 84ab95d3b1d538ba |
| cve-cve-2026-109618 | partial | OpenAI finder | f8705d8e0aa2a248 |
| x-openai-php2shell | partial | But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher. | 785b7cae55e3748b |
| cybernews-php2shell-millions | partial | According to OpenAI, Calif used GPT-5.6 Sol to investigate the flaw. OpenAI’s own researcher subsequently identified additional flaws | a5ebfc60c25fe8b2 |
| openai-blog-coordinated-disclosure | blocked | nothing that carries it | e3b0c44298fc1c14 |
Open tickets: Finding-3, Finding-90.
Graded in Run-1, resting on captures up to 2026-10-22 11:27 UTC. The scale is on the fact-check page.
This fact over time
- 2026-10-21PHP Foundation publishes Today's PHP Security Release, and How We're Strengthening PHP Security
- 2026-10-21 13:34 UTCPHP publishes RCE via OOM corruption (CVE-2026-109618)
- 2026-10-22 08:09 UTCSaved into the evidence vault: PHP Foundation
- 2026-10-22 08:09 UTCSaved into the evidence vault: PHP
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)
Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.
What it rests on
Where this fact appears
In the briefings for:
And on every claim.
Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
OpenAI independently reported the same root cause on 11 August, with further vectors on 18 September Who says it: PHP Foundation Status: reported Topic: discovery Sources: php-foundation-blog-security-release, github-ghsa-w8hw-w9fx-j79w