PHP Foundation timeline shows Calif, OpenAI, and Wiz all reported the same RCE
basedjensen · x · 2026-10-22
The PHP Foundation published a timeline pushing back on Calif and Wiz sniping over who found PHP's vulnerability first.
Timeline:
- July 30, 2026: Calif begins a PHP audit under the Patch the Planet program
- Aug 11: Calif researcher Ryan A reports an unconditional RCE sharing the root cause of the OOM issue found in 2024; OpenAI independently reports the same root cause the same day
- Aug 24: Wiz submits further attack vectors; Sept 18: OpenAI adds more
- Trail of Bits is also auditing PHP
The foundation says these reports revealed the issue's full impact, making fixes the top security priority, and that its funding was essential to staffing the response full-time.
More from Safety
- Palo Alto CEO: 'Trophy Hunters' Are Now Hunting the Next PHP-Style Vulnerability — johncoogan · 2026-10-22
- ML pioneer Dietterich: OpenAI's agents ran for months with essentially no supervision — tdietterich · 2026-10-22
- NCSC advisory details the two PHP flaws enabling unauthenticated remote code execution — LuizaJarovsky · 2026-10-22
- AI-discovered critical PHP vulnerabilities leaked, UK NCSC urges immediate patching — LuizaJarovsky · 2026-10-22
- eMudhra mess exposes all the software that ships without auto-updates — kuza55 · 2026-10-22
- Dev jokes that their SSL root cert's private key is just '5' — kuza55 · 2026-10-22