# Source: PHP2Shell — AI uncovers critical vulnerabilities in the backbone of the web

OpenAI / Wiz / Calif joint microsite (php2shell.com): what it says, the claims and events that cite it, and the hashes of every captured file.

Source · researcher · primary · captured

# PHP2Shell — AI uncovers critical vulnerabilities in the backbone of the web

**OpenAI / Wiz / Calif joint microsite (php2shell.com)** · [https://www.php2shell.com/](https://www.php2shell.com/) · published not stated · added by `claude-story-site` · slug `php2shell-com`

The researchers' joint site: credits, '70% of websites', demonstrated RCE on WordPress, Drupal, Joomla; FPM RCE via application-level paths; memory disclosure.

## What it says, as the collector read it

#### PHP2Shell — AI uncovers critical vulnerabilities in the backbone of the web

Captured by claude-story-site. Status: captured. The researchers' joint site: credits, '70% of websites', demonstrated RCE on WordPress, Drupal, Joomla; FPM RCE via application-level paths; memory disclosure.

- Credits: Wiz Research (Sagi Tzadik, Shir Tamari, Nir Ohfeld, Tomer Schwartz); OpenAI Codex Security (Amy Burnett); Calif (Ryan A.). Linked from patchtheplanet.org.

- 'PHP powers approximately 70% of websites'; 'a simple Hello World application running on an affected PHP version' is affected.

- 'PHP-FPM RCE was confirmed through application-level code paths.' 'Upgrading PHP is the only complete remediation.'

- No date on the page.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261022T111831Z · HTTP 200 · https://www.php2shell.com/- `headers.json` 95d2d3cfe2f388045327d30e2dd08bb49dd3e8dd426ae09aa80e1261f01cd7ed 1,509 bytes
- `page.html` 8c12d8880e5b0e798d3e4457997397a1c0de6b36ab774a8fe46518f3270532a0 284,683 bytes
- `provenance.json` 020c3cad8f308d11c8454cbf625b7310e0958428a69ade312c2cd43d349c2897 952 bytes
- `rendered.html` e5958b710931a3753baaa7475dea5c3be9f08677412269976d9e50100e3f9022 506,683 bytes
- `screenshot.png` 77a8c0a27f91ee02eab5575847f4611e6605f030f286c20c51eb4de3cf0f496a 2,152,724 bytes
- `text.txt` b1e83b4f0feb87d5abb59bfb76015b154a7b678a51c0e965e06929f1e6b17f48 9,251 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.2.5 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/sources/php2shell-com/index.html