# Fact: OpenAI independently reported the same root cause on 11 August, with further vec

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

OpenAI independently reported the same root cause on 11 August, with further vectors on 18 September Who says it, its status (reported), its sources, and its timeline from publication to this site.

Fact · discovery · reported

# OpenAI independently reported the same root cause on 11 August, with further vectors on 18 September

**Who says it:** PHP Foundation · **Sources:** [PHP Foundation](../../sources/php-foundation-blog-security-release/index.html) [PHP](../../sources/github-ghsa-w8hw-w9fx-j79w/index.html)

The GitHub advisories credit amyb-oai among four reporters. OpenAI's own post credits Calif's discovery 'using GPT-5.6 Sol' and Wiz; an X Community Note disputes OpenAI's role.

## Fact-check

**A2** Reported●●○○○○ disputed · Attribution · verdict: **holds**

The Foundation's page says this word for word (one named primary party, the recipient of the reports). The GHSA credits and the CVE records corroborate that OpenAI was a credited reporter or finder but carry no dates. OpenAI's own account is blocked; Cybernews relays OpenAI as saying its researcher 'subsequently' found additional flaws after Calif, and the X Community Note disputes OpenAI's discovery role.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [php-foundation-blog-security-release](../../sources/php-foundation-blog-security-release/index.html) | carries | *OpenAI independently reported the same root cause on the same day, followed by further attack vectors from OpenAI on September 18th* | a1be057adc1c5bfa |
| [github-ghsa-w8hw-w9fx-j79w](../../sources/github-ghsa-w8hw-w9fx-j79w/index.html) | partial | * amyb-oai Reporter* | 84ab95d3b1d538ba |
| [cve-cve-2026-109618](../../sources/cve-cve-2026-109618/index.html) | partial | *OpenAI finder* | f8705d8e0aa2a248 |
| [x-openai-php2shell](../../sources/x-openai-php2shell/index.html) | partial | *But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.* | 785b7cae55e3748b |
| [cybernews-php2shell-millions](../../sources/cybernews-php2shell-millions/index.html) | partial | *According to OpenAI, Calif used GPT-5.6 Sol to investigate the flaw. OpenAI’s own researcher subsequently identified additional flaws* | a5ebfc60c25fe8b2 |
| [openai-blog-coordinated-disclosure](../../sources/openai-blog-coordinated-disclosure/index.html) | blocked | *nothing that carries it* | e3b0c44298fc1c14 |

Open tickets: [Finding-3](../../factcheck/index.html#Finding-3), [Finding-90](../../factcheck/index.html#Finding-90).

Graded in Run-1, resting on captures up to 2026-10-22 11:27 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-21PHP Foundation publishes [Today's PHP Security Release, and How We're Strengthening PHP Security](../../sources/php-foundation-blog-security-release/index.html)
- 2026-10-21 13:34 UTCPHP publishes [RCE via OOM corruption (CVE-2026-109618)](../../sources/github-ghsa-w8hw-w9fx-j79w/index.html)
- 2026-10-22 08:09 UTCSaved into the evidence vault: PHP Foundation
- 2026-10-22 08:09 UTCSaved into the evidence vault: PHP
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
RRowanJournalistAAshSecurity researcherBBlakeAnalyst or policy advisorRRileyCommunications team
And on [every claim](../../claims/index.html#openai-same-day).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
```
OpenAI independently reported the same root cause on 11 August, with further vectors on 18 September
Who says it: PHP Foundation
Status: reported
Topic: discovery
Sources: php-foundation-blog-security-release, github-ghsa-w8hw-w9fx-j79w
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/openai-same-day/index.html