PHP RCE vulnerability found independently by OpenAI, Calif and Wiz
A critical PHP RCE vulnerability was independently reported by Calif, OpenAI and Wiz, sparking a dispute over who found it first. PHP Foundation released a disclosure timeline, and detailed technical analyses covered how GPT-5.6Sol discovered two CVEs under the Patch the Planet program.
2026-10-22 ~ 2026-10-22 · 2 related posts
- Episode 1: AI-Assisted Discovery of Critical Unauthenticated RCE Flaws in PHP Triggers Emergency Patch(2026-10-21, 75 posts)
- Episode 2: Researchers Predict LLM Audits Will Uncover More PHP Vulnerabilities(2026-10-21, 3 posts)
- Episode 3: PHP RCE proof-of-concept confirmed working, but not one-click(2026-10-21, 2 posts)
- Episode 4: Security's 'Black October': PHP, GitLab, LiteLLM and More Hit by Wave of Vulnerabilities(2026-10-21, 8 posts)
- Episode 5: POC Released for Critical Pre-Auth RCE in PHP session.upload_progress(2026-10-21, 2 posts)
- Episode 6: PHP 8.5.12 Patch Incomplete: php2shell Double-Free Still Exploitable(2026-10-22, 2 posts)
- Episode 7: FBI and NSA Issue Rare Alerts Over Critical PHP RCE Flaws(2026-10-22, 4 posts)
- Episode 8: PHP RCE vulnerability found independently by OpenAI, Calif and Wiz(2026-10-22, 2 posts)
- Episode 9: Critical PHP Zero-Day Affecting 80% of Websites Set for Disclosure(2026-10-22, 2 posts)
- PHP Foundation timeline shows Calif, OpenAI, and Wiz all reported the same RCE — basedjensen · 2026-10-22
- PHP2Shell anatomy: two RCE bugs AI found, the Defender's Window, and the disclosure that leaked early — 机器之心 · 2026-10-22