Source · social · primary · captured

LCFR on X: hash commitment d935be02…

Ryan Austin (@lcfr_hax), Calif · https://x.com/lcfr_hax/status/2085031675382071483 · published 2026-08-05T15:54Z · added by collector-researchers · slug x-lcfr-hax-hash-tweet

Hash-only tweet shown as '15:54 · 5 Aug 2026' (capture browser in UTC). Cited by Calif's timeline and by X Community Note on OpenAI's post as proof of prior discovery. Pre-image not published here.

Calif found the flaws first: discovery 1 August, hash comm…2026-08-05 15:54 UTC: Ryan Austin (@lcfr_hax) posts a SHA-…Ryan Austin , Calif on X

What it says, as the collector read it

@lcfr_hax (Ryan Austin, Calif): hash tweet, 5 Aug 2026

  • Text is only a SHA-256-style hex string: "d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac". Displayed "15:54 · 5 Aug 2026"; 565.5K views at capture.
  • Calif's write-up: "2026 — August 5 Calif researcher Ryan Austin (@lcfr_hax) tweeted hash of one finding." It is a priority commitment: it predates Wiz's stated discovery (Aug 19) and the PHP Foundation's record of first reports (Aug 11).
  • Pre-image not published (as far as seen). We cannot verify what the hash commits to. Open question: has Calif released the pre-image?
  • Replies (third-party): @trythreews: "Let's set the record straight. @lcfr_hax was the first to discover php2shell and develop a working exploit. His work convinced the PHP Foundation to invest in fixing this entire bug class."
  • X's own snowflake ID 2085031675382071483 could be decoded to a timestamp for independent confirmation of the date (not done here).

Claims that cite it

ClaimWho says itStatusPrimarySources
Calif found the flaws first: discovery 1 August, hash commitment 5 August, report to PHP 11 August
The hash tweet is dated 5 August 2026 on X; its pre-image has not been published, so what it commits to cannot be checked.
Calif; PHP Foundation (report date)confirmed3/3Calif Ryan Austin , Calif on X PHP Foundation

Events that cite it

WhenEventTime is
2026-08-05 15:54 UTCRyan Austin (@lcfr_hax) posts a SHA-256 hash on X as a commitment to one finding.stated

The bytes

capture 20261022T081603Z · HTTP 200 · https://x.com/lcfr_hax/status/2085031675382071483
  • headers.json ea81d1bf086428a65e67d0551ac1c3aebc53a1cd4c39b43d3ed837bbd8acee28 9,022 bytes
  • page.html 11a7ec8817e3966590490fb928089c210339261afe54cc2f72353dca15f41391 132,347 bytes
  • provenance.json 508544ce2c74aa23119fa27daa5a30b5ae63e47e7cd3e690fb9cf9a54ef7cded 1,012 bytes
  • rendered.html 9a1b5b36d22e9689e136b35c76adc712c6977f4ec6f1bd41655bdb1caff65fac 160,702 bytes
  • screenshot.png 9dfa4845de672eb2ec27885a9cff17fe9af803635a290c1cfc17f6ee5902d54e 262,114 bytes
  • text.txt 2c10f3991caf3a74b21df9d9e0362fd1bab8aefc5113877a412dac999ca36372 1,018 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →