Dispute Erupts Over Credit for PHP2Shell Vulnerability

The security community is debating who first discovered the PHP2Shell vulnerability: @califio credits @lcfrhax as the original finder with an August 5 tweet as evidence, while researcher James Berthoty defends Wiz, citing the PHP Foundation timeline to argue the flaw was independently found by multiple teams.

2026-10-21 ~ 2026-10-23 · 3 related posts

• php2shell credit war: @lcfr_hax confirmed as first to find and exploit the PHP bug class — basedjensen · 2026-10-21
• Defending Wiz on PHP2Shell: vulnerability was independently found by multiple teams — JamesBerthoty · 2026-10-23
• AI security drama: rez0 accuses Wiz of credit-grabbing over PHP2Shell vulnerability disclosure — rez0__ · 2026-10-23