# Source: LCFR on X: hash commitment d935be02…

Ryan Austin (@lcfr_hax), Calif: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · social · primary · captured

# LCFR on X: hash commitment d935be02…

**Ryan Austin (@lcfr_hax), Calif** · [https://x.com/lcfr_hax/status/2085031675382071483](https://x.com/lcfr_hax/status/2085031675382071483) · published 2026-08-05T15:54Z · added by `collector-researchers` · slug `x-lcfr-hax-hash-tweet`

Hash-only tweet shown as '15:54 · 5 Aug 2026' (capture browser in UTC). Cited by Calif's timeline and by X Community Note on OpenAI's post as proof of prior discovery. Pre-image not published here.

## What it says, as the collector read it

#### @lcfr_hax (Ryan Austin, Calif): hash tweet, 5 Aug 2026

- Text is only a SHA-256-style hex string: "d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac". Displayed "15:54 · 5 Aug 2026"; 565.5K views at capture.

- Calif's write-up: "2026 — August 5 Calif researcher Ryan Austin (@lcfr_hax) tweeted hash of one finding." It is a priority commitment: it predates Wiz's stated discovery (Aug 19) and the PHP Foundation's record of first reports (Aug 11).

- Pre-image not published (as far as seen). We cannot verify what the hash commits to. Open question: has Calif released the pre-image?

- Replies (third-party): @trythreews: "Let's set the record straight. @lcfr_hax was the first to discover php2shell and develop a working exploit. His work convinced the PHP Foundation to invest in fixing this entire bug class."

- X's own snowflake ID 2085031675382071483 could be decoded to a timestamp for independent confirmation of the date (not done here).

## Claims that cite it

| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| Calif found the flaws first: discovery 1 August, hash commitment 5 August, report to PHP 11 AugustThe hash tweet is dated 5 August 2026 on X; its pre-image has not been published, so what it commits to cannot be checked. | Calif; PHP Foundation (report date) | confirmed | 3/3 | [Calif](../../sources/calif-php2shell/index.html) [Ryan Austin , Calif on X](../../sources/x-lcfr-hax-hash-tweet/index.html) [PHP Foundation](../../sources/php-foundation-blog-security-release/index.html) |

## Events that cite it

| When | Event | Time is |
|---|---|---|
| 2026-08-05 15:54 UTC | Ryan Austin (@lcfr_hax) posts a SHA-256 hash on X as a commitment to one finding. | stated |

## The bytes
capture 20261022T081603Z · HTTP 200 · https://x.com/lcfr_hax/status/2085031675382071483- `headers.json` ea81d1bf086428a65e67d0551ac1c3aebc53a1cd4c39b43d3ed837bbd8acee28 9,022 bytes
- `page.html` 11a7ec8817e3966590490fb928089c210339261afe54cc2f72353dca15f41391 132,347 bytes
- `provenance.json` 508544ce2c74aa23119fa27daa5a30b5ae63e47e7cd3e690fb9cf9a54ef7cded 1,012 bytes
- `rendered.html` 9a1b5b36d22e9689e136b35c76adc712c6977f4ec6f1bd41655bdb1caff65fac 160,702 bytes
- `screenshot.png` 9dfa4845de672eb2ec27885a9cff17fe9af803635a290c1cfc17f6ee5902d54e 262,114 bytes
- `text.txt` 2c10f3991caf3a74b21df9d9e0362fd1bab8aefc5113877a412dac999ca36372 1,018 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.2.5 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/sources/x-lcfr-hax-hash-tweet/index.html