Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Fact · discovery · reported
Wiz Research independently discovered the first flaw on 19 August and reported on 24 August
Wiz's X post says 'Wiz Research uncovers' with no credit to Calif or OpenAI; the blog thanks both.
Fact-check
A2 Reported●●○○○○ · Attribution · verdict: holds in part
Wiz's timeline carries 'discovers the first PHP vulnerability' on 19 August and the report on 24 August, and the Foundation independently confirms a Wiz report on 24 August. 'Independently' is not in any captured primary: Wiz itself says it worked with Calif and OpenAI 'on discovery', and the Foundation frames Wiz's report as 'further attack vectors'. 'The first flaw' means Wiz's first finding, not the first flaw overall.
| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| wiz-blog-php2shell | partial | August 19, 2026: Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol. | e3568b6f88c93f6b |
| php-foundation-blog-security-release | partial | followed by further attack vectors from OpenAI on September 18th and from Wiz on August 24th. | a1be057adc1c5bfa |
| x-wiz-io-php2shell | partial | BREAKING: @wiz_io Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet. | 6c17977662815b0c |
Open tickets: Finding-115, Finding-4.
Graded in Run-1, resting on captures up to 2026-10-22 08:16 UTC. The scale is on the fact-check page.
This fact over time
- 2026-10-21Wiz publishes PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
- 2026-10-21PHP Foundation publishes Today's PHP Security Release, and How We're Strengthening PHP Security
- 2026-10-22 08:09 UTCSaved into the evidence vault: PHP Foundation
- 2026-10-22 08:10 UTCSaved into the evidence vault: Wiz
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)
Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.
What it rests on
Where this fact appears
In the briefings for:
And on every claim.
Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
Wiz Research independently discovered the first flaw on 19 August and reported on 24 August Who says it: Wiz; PHP Foundation (24 August) Status: reported Topic: discovery Sources: wiz-blog-php2shell, php-foundation-blog-security-release