Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Fact · technical · reported
Pre-authentication RCE was confirmed against WordPress, Drupal, Joomla, MediaWiki, Roundcube, Magento, phpMyAdmin, Nextcloud, Laravel, Symfony and WHMCS
Two researcher parties, no third-party reproduction in the vault. The demo videos were not downloaded.
Fact-check
A2 Reported●●○○○○ · State · verdict: holds
Calif's own post lists all eleven applications as confirmed pre-auth RCE; Wiz independently confirms WordPress, Drupal and Joomla. The full list rests on one named party (A2); WordPress/Drupal/Joomla alone would be A4. No third-party reproduction in the vault (Huntress says it did not reproduce), so 'reported' fits.
| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| calif-php2shell | carries | We confirmed pre-auth RCE on the following PHP apps as well as arbitrary PHP scripts in some instances. | 23afef81971778f9 |
| wiz-blog-php2shell | partial | demonstrated that it could execute code remotely without authentication on deployments of WordPress (wordpress:latest), Drupal (drupal:latest), and Joomla (joomla:latest) | e3568b6f88c93f6b |
| huntress-php2shell-rapid-response | absent | We have not built or reproduced a proof of concept for these vulnerabilities | a83d744768109a61 |
Open tickets: Finding-116.
Graded in Run-1, resting on captures up to 2026-10-22 08:10 UTC. The scale is on the fact-check page.
This fact over time
- 2026-10-21Calif publishes php2shell by Calif Research — A tale of two PHP remote vulnerabilities
- 2026-10-21Wiz publishes PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
- 2026-10-22 08:10 UTCSaved into the evidence vault: Calif
- 2026-10-22 08:10 UTCSaved into the evidence vault: Wiz
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)
Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.
What it rests on
Where this fact appears
In the briefings for:
And on every claim.
Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
Pre-authentication RCE was confirmed against WordPress, Drupal, Joomla, MediaWiki, Roundcube, Magento, phpMyAdmin, Nextcloud, Laravel, Symfony and WHMCS Who says it: Calif; Wiz for WordPress and Drupal Status: reported Topic: technical Sources: calif-php2shell, wiz-blog-php2shell