{
  "api_version": "1",
  "updated": "2026-10-22",
  "latest_event": "2026-10-21",
  "rights": "© Frontier Log, all rights reserved.",
  "story": {
    "slug": "php2shell-disclosure",
    "title": "php2shell Disclosure Timeline",
    "description": "When Calif, OpenAI and Wiz found and reported the php2shell PHP vulnerabilities, as each party's own records and the PHP Foundation's post date it.",
    "url": "https://frontierlog.ai/stories/php2shell-disclosure",
    "date": "2026-10-22",
    "image": "https://frontierlog.ai/og/story-php2shell-disclosure.png",
    "event": "2026-10-21-php2shell-disclosure",
    "tags": [
      "cybersecurity"
    ],
    "steps": [],
    "tables": [],
    "records": [
      {
        "date": "2026-06-22",
        "party": "OpenAI",
        "what": "announces Patch the Planet",
        "by": "OpenAI",
        "source": "https://openai.com/index/patch-the-planet"
      },
      {
        "date": "2026-07-30",
        "party": "Calif",
        "what": "begins auditing PHP",
        "by": "PHP Foundation",
        "source": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/",
        "quote": "The PHP Foundation got the PHP project into the Patch the Planet program, as part of which security firm Calif began an audit of PHP on July 30th, 2026."
      },
      {
        "date": "2026-08-01",
        "party": "Calif",
        "what": "finds several RCE paths",
        "by": "Calif",
        "source": "https://calif.io/php2shell/",
        "quote": "Calif discovered multiple different paths independently leading to RCE that resurfaced the 2024 issues and new trigger points.",
        "key": true
      },
      {
        "date": "2026-08-05",
        "party": "Calif",
        "what": "'s Ryan Austin posts a hash on X",
        "by": "Calif",
        "source": "https://calif.io/php2shell/",
        "quote": "Calif researcher Ryan Austin (@lcfr_hax) tweeted hash of one finding.",
        "also": [
          {
            "by": "Ryan Austin",
            "source": "https://x.com/lcfr_hax/status/2085031675382071483"
          }
        ]
      },
      {
        "date": "2026-08-11",
        "party": "Calif",
        "what": "'s Ryan Austin reports the first bug",
        "by": "PHP Foundation",
        "source": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/",
        "quote": "On August 11th researcher Ryan A at Calif reported an unconditional remote code execution with the same root cause as the OOM problem we had found in 2024.",
        "key": true,
        "also": [
          {
            "by": "Calif",
            "source": "https://calif.io/php2shell/"
          }
        ]
      },
      {
        "date": "2026-08-11",
        "party": "OpenAI",
        "what": "reports the same root cause",
        "by": "PHP Foundation",
        "source": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/",
        "quote": "OpenAI independently reported the same root cause on the same day",
        "note": "Only the PHP Foundation's post gives this date.",
        "key": true
      },
      {
        "date": "2026-08-14",
        "party": "Calif",
        "what": "shares a working exploit",
        "by": "Calif",
        "source": "https://calif.io/php2shell/",
        "quote": "Calif shared an RCE PoC with PHP."
      },
      {
        "date": "2026-08-19",
        "party": "Wiz",
        "what": "finds its first vulnerability",
        "by": "Wiz",
        "source": "https://www.wiz.io/blog/php2shell-php-rce",
        "quote": "Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.",
        "key": true
      },
      {
        "date": "2026-08-21",
        "party": "Calif",
        "what": "reports a second bug",
        "by": "Calif",
        "source": "https://calif.io/php2shell/",
        "quote": "Calif reported the second bug to PHP."
      },
      {
        "date": "2026-08-24",
        "party": "Wiz",
        "what": "reports to the PHP security team",
        "by": "Wiz",
        "source": "https://www.wiz.io/blog/php2shell-php-rce",
        "quote": "Wiz Research reports the vulnerabilities to the PHP security team.",
        "key": true
      },
      {
        "date": "2026-09-18",
        "party": "OpenAI",
        "what": "reports further attack vectors",
        "by": "PHP Foundation",
        "source": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/",
        "quote": "followed by further attack vectors from OpenAI on September 18th",
        "note": "Only the PHP Foundation's post gives this date."
      },
      {
        "date": "2026-10-20",
        "party": "PHP project",
        "what": "'s CVE IDs leak",
        "by": "PHP Foundation",
        "source": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/",
        "quote": "On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media."
      },
      {
        "date": "2026-10-21",
        "party": "PHP project",
        "what": "releases fixes",
        "by": "PHP Foundation",
        "source": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/",
        "quote": "Earlier today, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.",
        "key": true,
        "also": [
          {
            "by": "CVE.org",
            "source": "https://www.cve.org/CVERecord?id=CVE-2026-109618"
          }
        ]
      }
    ],
    "statements": [
      {
        "date": "2026-10-21",
        "party": "PHP Foundation",
        "by": "PHP Foundation",
        "source": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/",
        "quote": "OpenAI independently reported the same root cause on the same day, followed by further attack vectors from OpenAI on September 18th and from Wiz on August 24th."
      },
      {
        "date": "2026-10-21",
        "party": "OpenAI",
        "by": "OpenAI",
        "source": "https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities",
        "quote": "Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet initiative, with Wiz also independently discovering and reporting both vulnerabilities."
      },
      {
        "party": "Calif",
        "by": "Calif",
        "source": "https://calif.io/php2shell/",
        "quote": "OpenAI invited us to join its Patch the Planet initiative, and PHP stood out as a high-impact target."
      },
      {
        "party": "Calif",
        "by": "Calif",
        "source": "https://calif.io/php2shell/",
        "quote": "No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery."
      },
      {
        "date": "2026-10-21",
        "party": "Calif",
        "by": "Calif",
        "source": "https://x.com/calif_io/status/2112914613297668583",
        "quote": "Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit."
      },
      {
        "date": "2026-10-21",
        "party": "Wiz",
        "by": "Wiz",
        "source": "https://www.wiz.io/blog/php2shell-php-rce",
        "quote": "We used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research."
      }
    ],
    "cites": [
      {
        "url": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/",
        "by": "PHP Foundation",
        "medium": "blog post",
        "date": "2026-10-21"
      },
      {
        "url": "https://calif.io/php2shell/",
        "by": "Calif",
        "medium": "research write-up"
      },
      {
        "url": "https://www.wiz.io/blog/php2shell-php-rce",
        "by": "Wiz",
        "medium": "blog post",
        "date": "2026-10-21"
      },
      {
        "url": "https://openai.com/index/patch-the-planet",
        "by": "OpenAI",
        "medium": "blog post",
        "date": "2026-06-22"
      },
      {
        "url": "https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities",
        "by": "OpenAI",
        "medium": "blog post",
        "date": "2026-10-21"
      },
      {
        "url": "https://www.cve.org/CVERecord?id=CVE-2026-109618",
        "by": "CVE.org",
        "medium": "CVE record",
        "date": "2026-10-21"
      },
      {
        "url": "https://x.com/lcfr_hax/status/2085031675382071483",
        "by": "Ryan Austin",
        "medium": "X post",
        "date": "2026-08-05"
      },
      {
        "url": "https://x.com/calif_io/status/2112914613297668583",
        "by": "Calif",
        "medium": "X post",
        "date": "2026-10-21"
      }
    ],
    "sources": [
      "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/",
      "https://calif.io/php2shell/",
      "https://www.wiz.io/blog/php2shell-php-rce",
      "https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities",
      "https://openai.com/index/patch-the-planet",
      "https://www.cve.org/CVERecord?id=CVE-2026-109618",
      "https://x.com/lcfr_hax/status/2085031675382071483",
      "https://x.com/calif_io/status/2112914613297668583"
    ]
  }
}