Claude Code flags fake "PHP2Shell" CVE from Wikipedia, refuses to patch a hoax
adulion · reddit · 2026-10-23
A user asked Claude Code to audit their PHP servers against a Wikipedia article, and Claude pushed back: the "PHP2Shell" incident is flagged as fictional/speculative (dated October 2026), with made-up CVE IDs (CVE-2026-109618/619) and a plot involving "OpenAI's Patch the Planet project."
Claude couldn't corroborate it in PHP security advisories, php.net release notes, or NVD, and explicitly refused to treat it as a patching reason—pointing to php.net/ChangeLog and NVD as authoritative sources. A notable anti-hallucination moment: the model verified sources instead of blindly trusting the citation.
More from Fun
- First-ever in-body prime editing treatment injected into a human — basedjensen · 2026-10-23
- AI Twitter drama: DeepSeek superfan blocked by scaling01 over model lore spat — teortaxesTex · 2026-10-23
- Run Lola Run director Tom Tykwer uses Seedance in hybrid AI filmmaking experiment — Uncanny_Harry · 2026-10-23
- "Still Worth Something" S01E01: a Pixar-style fully AI-animated comedy short — LPGroves · 2026-10-23
- Halloween AI short: "Careful who you bring home" — glagolef · 2026-10-23
- Dev builds a VST synth with Codex and MCP, lets the AI jam in his studio — Yamapama · 2026-10-23