# Fact: Calif found the flaws first: discovery 1 August, hash commitment 5 August, repor

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Calif found the flaws first: discovery 1 August, hash commitment 5 August, report to PHP 11 August Who says it, its status (confirmed), its sources, and its timeline from publication to this site.

Fact · discovery · confirmed

# Calif found the flaws first: discovery 1 August, hash commitment 5 August, report to PHP 11 August

**Who says it:** Calif; PHP Foundation (report date) · **Sources:** [Calif](../../sources/calif-php2shell/index.html) [Ryan Austin, Calif on X](../../sources/x-lcfr-hax-hash-tweet/index.html) [PHP Foundation](../../sources/php-foundation-blog-security-release/index.html)

The hash tweet is dated 5 August 2026 on X; its pre-image has not been published, so what it commits to cannot be checked.

## Fact-check

**A3** Echoed●●●○○○ opinion measures differently status overstated · Opinion · verdict: **holds in part** · the status word overstates the evidence

The dates under it are well carried: the hash tweet date is on X and the snowflake ID 2085031675382071483 decodes to 2026-08-05T15:54:24Z (A6); the 11 August report is in both Calif's and the Foundation's pages (A5); the 1 August discovery date is Calif's own word only (A2). 'Found the flaws first' is a reading (max A3): the Foundation says the OOM root cause was found in 2024, OpenAI reported the same root cause the same day, and nothing shows Calif found the second CVE first.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [calif-php2shell](../../sources/calif-php2shell/index.html) | carries | *Calif researcher Ryan Austin (@lcfr_hax) tweeted hash of one finding.* | 23afef81971778f9 |
| [x-lcfr-hax-hash-tweet](../../sources/x-lcfr-hax-hash-tweet/index.html) | carries | *d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac 15:54 · 5 Aug 2026* | 2c10f3991caf3a74 |
| [php-foundation-blog-security-release](../../sources/php-foundation-blog-security-release/index.html) | partial | *On August 11th researcher Ryan A at Calif reported an unconditional remote code execution with the same root cause as the OOM problem* | a1be057adc1c5bfa |
| [cve-cve-2026-109618](../../sources/cve-cve-2026-109618/index.html) | partial | *Ryan at Calif.io reporter Wiz reporter OpenAI finder* | f8705d8e0aa2a248 |

Open tickets: [Finding-113](../../factcheck/index.html#Finding-113), [Finding-2](../../factcheck/index.html#Finding-2).

Graded in Run-1, resting on captures up to 2026-10-22 08:16 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-08-05 15:54 UTCRyan Austin, Calif on X publishes [LCFR on X: hash commitment d935be02…](../../sources/x-lcfr-hax-hash-tweet/index.html)
- 2026-10-21Calif publishes [php2shell by Calif Research — A tale of two PHP remote vulnerabilities](../../sources/calif-php2shell/index.html)
- 2026-10-21PHP Foundation publishes [Today's PHP Security Release, and How We're Strengthening PHP Security](../../sources/php-foundation-blog-security-release/index.html)
- 2026-10-22 08:09 UTCSaved into the evidence vault: PHP Foundation
- 2026-10-22 08:10 UTCSaved into the evidence vault: Calif
- 2026-10-22 08:16 UTCSaved into the evidence vault: Ryan Austin, Calif on X
- 2026-10-22Enters this site as confirmed in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
RRowanJournalistAAshSecurity researcherBBlakeAnalyst or policy advisorRRileyCommunications team
And on [every claim](../../claims/index.html#who-first).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · confirmed
```
Calif found the flaws first: discovery 1 August, hash commitment 5 August, report to PHP 11 August
Who says it: Calif; PHP Foundation (report date)
Status: confirmed
Topic: discovery
Sources: calif-php2shell, x-lcfr-hax-hash-tweet, php-foundation-blog-security-release
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/who-first/index.html