php2shell Disclosure Timeline
When Calif, OpenAI and Wiz found and reported the php2shell PHP vulnerabilities, as each party's own records and the PHP Foundation's post date it.
php2shell Disclosure Timeline
Calif and OpenAI reported on 11 Aug, Wiz on 24 Aug; fixed 21 Oct
The PHP Foundation's post dates Calif's and OpenAI's reports to 11 August and Wiz's to 24 August; Calif's own timeline has its first finding on 1 August. OpenAI's two dates come only from the PHP Foundation's post.
Timeline
| Date | What happened |
|---|---|
| OpenAI announces Patch the PlanetOpenAI, blog post | |
Calif begins auditing PHPThe PHP Foundation got the PHP project into the Patch the Planet program, as part of which security firm Calif began an audit of PHP on July 30th, 2026.PHP Foundation, blog post | |
Calif finds several RCE pathsCalif discovered multiple different paths independently leading to RCE that resurfaced the 2024 issues and new trigger points.Calif, research write-up | |
Calif's Ryan Austin posts a hash on XCalif researcher Ryan Austin (@lcfr_hax) tweeted hash of one finding.Calif, research write-upRyan Austin, X post | |
Calif's Ryan Austin reports the first bugOn August 11th researcher Ryan A at Calif reported an unconditional remote code execution with the same root cause as the OOM problem we had found in 2024.PHP Foundation, blog postCalif, research write-up | |
OpenAI reports the same root causeOpenAI independently reported the same root cause on the same dayOnly the PHP Foundation's post gives this date.PHP Foundation, blog post | |
Calif shares a working exploitCalif shared an RCE PoC with PHP.Calif, research write-up | |
Wiz finds its first vulnerabilityWiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.Wiz, blog post | |
Calif reports a second bugCalif reported the second bug to PHP.Calif, research write-up | |
Wiz reports to the PHP security teamWiz Research reports the vulnerabilities to the PHP security team.Wiz, blog post | |
OpenAI reports further attack vectorsfollowed by further attack vectors from OpenAI on September 18thOnly the PHP Foundation's post gives this date.PHP Foundation, blog post | |
PHP project's CVE IDs leakOn Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media.PHP Foundation, blog post | |
PHP project releases fixesEarlier today, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.PHP Foundation, blog postCVE.org, CVE record |
Statements
| Party | Statement |
|---|---|
| PHP Foundation | OpenAI independently reported the same root cause on the same day, followed by further attack vectors from OpenAI on September 18th and from Wiz on August 24th.PHP Foundation, blog post |
| OpenAI | Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet initiative, with Wiz also independently discovering and reporting both vulnerabilities.OpenAI, blog post |
| Calif | OpenAI invited us to join its Patch the Planet initiative, and PHP stood out as a high-impact target.Calif, research write-up |
| Calif | No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery.Calif, research write-up |
| Calif | Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit.Calif, X post |
| Wiz | We used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research.Wiz, blog post |