Defending Wiz on PHP2Shell: vulnerability was independently found by multiple teams
JamesBerthoty · x · 2026-10-23
Security researcher James Berthoty argues the backlash against Wiz's handling of PHP2Shell is unwarranted. Quoting the PHP Foundation's blog, he lays out the timeline: Calif (via OpenAI's Patch the Planet program) began auditing PHP on July 30, 2026 and reported an unconditional RCE sharing the 2024 OOM root cause on Aug 11; OpenAI independently reported the same root cause, Wiz submitted additional attack vectors on Aug 24, OpenAI added more on Sept 18, and Trail of Bits is also auditing. The author says Calif clearly found it first, but Wiz credited collaborators and published responder resources—so claims of credit-grabbing lack receipts.
Related event: Dispute Erupts Over Credit for PHP2Shell Vulnerability Disclosure(4 posts)→