# Fact: Wiz Research independently discovered the first flaw on 19 August and reported o

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Wiz Research independently discovered the first flaw on 19 August and reported on 24 August Who says it, its status (reported), its sources, and its timeline from publication to this site.

Fact · discovery · reported

# Wiz Research independently discovered the first flaw on 19 August and reported on 24 August

**Who says it:** Wiz; PHP Foundation (24 August) · **Sources:** [Wiz](../../sources/wiz-blog-php2shell/index.html) [PHP Foundation](../../sources/php-foundation-blog-security-release/index.html)

Wiz's X post says 'Wiz Research uncovers' with no credit to Calif or OpenAI; the blog thanks both.

## Fact-check

**A2** Reported●●○○○○ · Attribution · verdict: **holds in part**

Wiz's timeline carries 'discovers the first PHP vulnerability' on 19 August and the report on 24 August, and the Foundation independently confirms a Wiz report on 24 August. 'Independently' is not in any captured primary: Wiz itself says it worked with Calif and OpenAI 'on discovery', and the Foundation frames Wiz's report as 'further attack vectors'. 'The first flaw' means Wiz's first finding, not the first flaw overall.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [wiz-blog-php2shell](../../sources/wiz-blog-php2shell/index.html) | partial | *August 19, 2026: Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.* | e3568b6f88c93f6b |
| [php-foundation-blog-security-release](../../sources/php-foundation-blog-security-release/index.html) | partial | *followed by further attack vectors from OpenAI on September 18th and from Wiz on August 24th.* | a1be057adc1c5bfa |
| [x-wiz-io-php2shell](../../sources/x-wiz-io-php2shell/index.html) | partial | *BREAKING: @wiz_io Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet.* | 6c17977662815b0c |

Open tickets: [Finding-115](../../factcheck/index.html#Finding-115), [Finding-4](../../factcheck/index.html#Finding-4).

Graded in Run-1, resting on captures up to 2026-10-22 08:16 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-21Wiz publishes [PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet](../../sources/wiz-blog-php2shell/index.html)
- 2026-10-21PHP Foundation publishes [Today's PHP Security Release, and How We're Strengthening PHP Security](../../sources/php-foundation-blog-security-release/index.html)
- 2026-10-22 08:09 UTCSaved into the evidence vault: PHP Foundation
- 2026-10-22 08:10 UTCSaved into the evidence vault: Wiz
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
RRowanJournalistAAshSecurity researcherBBlakeAnalyst or policy advisorRRileyCommunications team
And on [every claim](../../claims/index.html#wiz-independent).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
```
Wiz Research independently discovered the first flaw on 19 August and reported on 24 August
Who says it: Wiz; PHP Foundation (24 August)
Status: reported
Topic: discovery
Sources: wiz-blog-php2shell, php-foundation-blog-security-release
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/wiz-independent/index.html