Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Fact · discovery · confirmed

Calif found the flaws first: discovery 1 August, hash commitment 5 August, report to PHP 11 August

Who says it: Calif; PHP Foundation (report date) · Sources: Calif Ryan Austin, Calif on X PHP Foundation

The hash tweet is dated 5 August 2026 on X; its pre-image has not been published, so what it commits to cannot be checked.

Fact-check

A3 Echoed opinion measures differently status overstated · Opinion · verdict: holds in part · the status word overstates the evidence

The dates under it are well carried: the hash tweet date is on X and the snowflake ID 2085031675382071483 decodes to 2026-08-05T15:54:24Z (A6); the 11 August report is in both Calif's and the Foundation's pages (A5); the 1 August discovery date is Calif's own word only (A2). 'Found the flaws first' is a reading (max A3): the Foundation says the OOM root cause was found in 2024, OpenAI reported the same root cause the same day, and nothing shows Calif found the second CVE first.

Capture checkedResultWhat it sayssha256 of the text read
calif-php2shellcarriesCalif researcher Ryan Austin (@lcfr_hax) tweeted hash of one finding.23afef81971778f9
x-lcfr-hax-hash-tweetcarriesd935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac 15:54 · 5 Aug 20262c10f3991caf3a74
php-foundation-blog-security-releasepartialOn August 11th researcher Ryan A at Calif reported an unconditional remote code execution with the same root cause as the OOM problema1be057adc1c5bfa
cve-cve-2026-109618partialRyan at Calif.io reporter Wiz reporter OpenAI finderf8705d8e0aa2a248

Open tickets: Finding-113, Finding-2.

Graded in Run-1, resting on captures up to 2026-10-22 08:16 UTC. The scale is on the fact-check page.

This fact over time

  1. 2026-08-05 15:54 UTCRyan Austin, Calif on X publishes LCFR on X: hash commitment d935be02…
  2. 2026-10-21Calif publishes php2shell by Calif Research — A tale of two PHP remote vulnerabilities
  3. 2026-10-21PHP Foundation publishes Today's PHP Security Release, and How We're Strengthening PHP Security
  4. 2026-10-22 08:09 UTCSaved into the evidence vault: PHP Foundation
  5. 2026-10-22 08:10 UTCSaved into the evidence vault: Calif
  6. 2026-10-22 08:16 UTCSaved into the evidence vault: Ryan Austin, Calif on X
  7. 2026-10-22Enters this site as confirmed in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

What it rests on

php2shell by Calif Research — A tale of two PHP remote vul…LCFR on X: hash commitment d935be02…Today's PHP Security Release, and How We're Strengthening …fact who-first

Where this fact appears

In the briefings for:

RowanJournalistAshSecurity researcherBlakeAnalyst or policy advisorRileyCommunications team

And on every claim.

Every version of this fact

v1 · site v0.1.0 · 22 October 2026 · confirmed
Calif found the flaws first: discovery 1 August, hash commitment 5 August, report to PHP 11 August
Who says it: Calif; PHP Foundation (report date)
Status: confirmed
Topic: discovery
Sources: calif-php2shell, x-lcfr-hax-hash-tweet, php-foundation-blog-security-release