Who Found PHP2Shell? Calif, Wiz and OpenAI Timeline
PHP2Shell was reported to PHP three times: Calif on Aug 11, Wiz on Aug 24, OpenAI on Sept 18. Who found it, how it leaked, and which versions fix it.
Three teams reported PHP2Shell (CVE-2026-109618 and CVE-2026-109619) to PHP: Calif on August 11, 2026, Wiz on August 24 and OpenAI on September 18, according to the PHP Foundation’s release post. Calif reported first. OpenAI ran the program Calif worked under and coordinated the fix.
So “OpenAI found the PHP bug” is a compression of three separate events. Calif’s Ryan Austin found the first trigger with an AI assistant inside OpenAI’s Patch the Planet program. Wiz found the same bug class on its own a few weeks later, using Google’s Gemini 4 Argon and GPT-5.6 Sol. OpenAI’s own Codex Security team then reported further attack vectors. And a PHP core developer had already spotted the out-of-memory weakness while fixing findings from a 2024 audit.
Who found PHP2Shell first?
Calif, by every primary account. The table below takes each party’s dates from its own write-up, and the report dates from PHP, the party that received them.
| Party | First finding | Reported to PHP | Tools named | Source |
|---|---|---|---|---|
| PHP core developer | During fixes for the 2024 audit | Internal | Not stated | PHP Foundation |
| Calif (Ryan Austin) | August 1, 2026 | August 11 (first bug), August 21 (second) | “My LLM companion”; GPT-5.6 Sol per OpenAI | Calif |
| Wiz Research | August 19, 2026 | August 24 | Wiz Atlas, Gemini 4 Argon, GPT-5.6 Sol | Wiz |
| OpenAI Codex Security (Amy Burnett) | Not stated | September 18 | Not stated | PHP Foundation |
PHP’s own GitHub advisories credit all three on both CVEs, alongside four PHP developers. The order differs: Calif’s researcher is listed first on CVE-2026-109618 and a Wiz researcher first on CVE-2026-109619, with OpenAI’s Amy Burnett credited on both.
Calif’s write-up, PHP2Shell (Ryan Austin, October 2026), gives the full sequence. The audit started on July 30 after OpenAI invited Calif into Patch the Planet and Calif picked PHP as a high-impact target. The first out-of-memory trigger turned up “only a few days after starting the audit,” on August 1. Calif reported the first bug on August 11, sent PHP a working remote code execution proof of concept on August 14, and PHP confirmed it the next day. The second bug followed on August 21.
Wiz’s post, PHP2Shell: AI uncovers critical RCE vulnerabilities (Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz, October 2026), dates its first finding to August 19. It confirmed unauthenticated code execution against Drupal on August 20 and WordPress on August 21, and reported to PHP on August 24. Per Wiz, PHP acknowledged the report on September 21.
| Step | Owner | What happens |
|---|---|---|
| 1 | Calif | Jul 30: audit starts under Patch the Planet |
| 2 | Calif | Aug 1: first OOM trigger found |
| 3 | PHP project | Aug 11: Calif report; Aug 15: PoC confirmed |
| 4 | Wiz | Aug 19: found independently |
| 5 | PHP project | Aug 24: Wiz report arrives |
| 6 | OpenAI | Sep 18: Codex Security reports more vectors |
| 7 | Leak and attackers | Oct 17: attempt seen by AWS honeypot (human sign-off) |
| 8 | Leak and attackers | Oct 20: CVE IDs and PoC video circulate (human sign-off) |
| 9 | PHP project | Oct 21, 14:00 UTC: fixed releases ship |
Did OpenAI find PHP2Shell, or did Calif?
Both claims hold, at different layers. OpenAI’s post, Patch the Planet: global response coordination as agents uncover critical vulnerabilities (October 21, 2026), says “Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet initiative, with Wiz also independently discovering and reporting both vulnerabilities.” OpenAI describes its own role as leading “a coalition of maintainers, researchers, and security providers” over two months.
Three details complicate the headline version.
- Calif’s write-up never names the model. It refers to “my LLM companion” and an “audit buddy,” and says “No special harness, or access to models that weren’t generally available to everyone were used.” The GPT-5.6 Sol attribution comes from OpenAI. That matters if you are trying to judge what an off-the-shelf GPT-5.6 Sol subscription can do: Calif’s claim is that a generally available model was enough.
- OpenAI also reported directly. The PHP Foundation credits “OpenAI Codex Security (Amy Burnett)” and dates OpenAI’s report to September 18, covering “the same root cause, then further vectors.” Decrypt reported this as OpenAI finding “a fuller version” in September.
- Wiz used both labs’ models. Wiz credits Gemini 4 Argon for contributions to finding the bug, building the exploit, detecting attacks and validating the patch, alongside GPT-5.6 Sol and its own Wiz Atlas tool. Wiz is part of Google Cloud.
The human prehistory is longer than any of the AI finds. Calif’s timeline traces PHP’s memory-limit bug class back to Stefan Esser’s 2004 research and a 2020 bug report. The PHP Foundation says the out-of-memory issue was “first spotted by a PHP core developer contracted by the Foundation” while fixing a finding from the 2024 Quarkslab audit funded through OSTIF. The team theorized an exploit then, but could not confirm one.
What the models changed was the step from “theoretically bad” to a working exploit. Wiz’s conclusion calls it “an AI inflection point.”
What is PHP2Shell, in plain words?
PHP2Shell is a memory-safety bug class in how PHP recovers from fatal errors, especially running out of memory. Most PHP servers reuse one worker process for many requests. If a request makes PHP hit its memory_limit at exactly the wrong moment, the worker abandons a half-finished data structure. The next request on that same worker picks up the stale state and treats attacker-shaped memory as trusted pointers. That is the path to remote code execution.
Three properties make it severe:
- No login needed. The trigger arrives in the request body, through multipart file uploads, before any application code runs.
- The application does not matter. Wiz says even a “Hello World” app on an affected PHP version can be vulnerable, and it demonstrated unauthenticated code execution on WordPress, Drupal and Joomla.
- It goes back a long way. Wiz says every PHP release from the last decade has at least one affected issue, and Calif’s early-startup path works on PHP 5.4.0 and later.
The two CVEs map to the two GitHub advisories: CVE-2026-109618, “RCE via OOM corruption” and CVE-2026-109619, “RCE via stale global state”. The PHP Foundation rates both 9.2 (critical) under CVSS v4.0. Some early posts said 10.0, a figure that leaked with the CVE IDs.
How did PHP2Shell leak before the patch?
From several directions at once, per the PHP Foundation’s timeline:
- October 20, around 15:00 UTC: the CVE IDs began circulating online, with a wrong release time and a CVSS of 10.0 but no technical details.
- October 20, 19:30 UTC: PHP published a pre-announcement.
- October 20: Calif “mistakenly published a video showing a working proof of concept.” Copies spread and reportedly sped up attackers’ work.
- October 21, 07:41 UTC: Chainguard published images containing the fix, which broke the embargo by exposing the changed code.
- October 21, 14:00 UTC: PHP shipped, one day ahead of the planned October 22 date.
The earliest signal came first, though. In Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot (AWS Security Blog, October 21, 2026), AWS says a honeypot recorded an exploitation attempt on October 17, four days before disclosure, from a commercial anonymization network. AWS says it is “unclear how the actor obtained exploit information” while the bug was under embargo. By release day it reported that “PHP2Shell is now seeing broad exploitation attempts in the wild.”
OpenAI president Greg Brockman said on X that “the tail end of the disclosure didn’t go as planned,” as reported by Decrypt.
Which PHP versions fix PHP2Shell?
PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, all released on October 21, 2026. Those are the supported branches. Older branches need a backport from your Linux distribution or hosting provider, or an upgrade.
| Your PHP branch | Fixed release | What to do |
|---|---|---|
| 8.5 | 8.5.12 | Upgrade now |
| 8.4 | 8.4.27 | Upgrade now |
| 8.3 | 8.3.36 | Upgrade now |
| 8.2 | 8.2.35 | Upgrade now |
| 8.1 and older | No official release | Distro backport, or move to a supported branch |
How do you check and fix a PHP server?
- Read the running version, not the installed package. Run
php -vfor the CLI, and check the version your web server actually loads (PHP-FPM and Apache mod_php can differ from the CLI). OpenAI published a PHP version checker as a Codex skill. A version string cannot show a backport, so on distro packages, check the vendor’s advisory too. - Upgrade to the fixed release for your branch and restart every PHP worker so no old process keeps serving requests.
- If you cannot patch today, add a stopgap. AWS suggests blocking multipart file uploads where the application allows it, after testing. Cloudflare, Fastly and Vercel published edge mitigations, per Wiz. AWS is clear that “no configuration-only workaround” covers both CVEs.
- Hunt for signs of an attempt. AWS says to search form-upload POST bodies for
PHP_SESSION_UPLOAD_PROGRESS. Wiz lists unusual multipart requests followed by memory-limit errors, bursts of HTTP 500s, oversized or malformedPHPSESSIDcookies and unexplained worker restarts. - Check for compromise back to October 17. Look for unexpected processes and changed files on web servers, per AWS.
What does three independent finds in seven weeks mean?
Two teams with frontier models landed on a bug class that had sat in PHP since at least 5.4 within 18 days of each other, Calif on August 1 and Wiz on August 19. OpenAI’s own team followed. Independent rediscovery that fast changes the economics of an embargo. A two-month coordination window assumes the finder holds a rare secret. When the same model is on sale to everyone, the secret has a short half-life, and the October 17 exploitation attempt suggests someone else had it too.
The maintainer side shows the strain. The PHP Foundation says it has published 15 CVEs since July 1, 2026, and worked through more than 100 reports that were invalid, duplicates or not reproducible, most of them a by-product of AI-assisted research. Its thanks list includes Alpha-Omega, OpenAI, Anthropic and the Sovereign Tech Agency for funding and tool access. OpenAI, for its part, says these bugs “are among several significant vulnerabilities we’ve already found” and that it expects “similar findings to increase sharply in the coming months.” It has committed $1 billion in subsidized access to Daybreak, its security offering, for under-resourced defenders.
That is the same capability story as the OpenAI agent that broke out of its sandbox and into Hugging Face in July, pointed in the defensive direction. The cost of finding a deep bug has fallen to roughly the cost of a model subscription and a skilled operator for a few days. The cost of patching the world has not fallen at all. If you run agents of your own, the harness engineering lesson carries over: assume the next PHP2Shell is already in someone else’s context window.
PHP2Shell: quick answers
- Who found PHP2Shell?
- Calif security researcher Ryan Austin reported it to PHP first, on August 11, 2026, working under OpenAI's Patch the Planet program. Wiz found it independently and reported on August 24, and OpenAI Codex Security reported further vectors on September 18.
- Did ChatGPT or GPT-5.6 Sol find the PHP bug?
- OpenAI says Calif used GPT-5.6 Sol. Calif's own write-up credits an unnamed LLM assistant and says it used only generally available models. Wiz used Gemini 4 Argon and GPT-5.6 Sol. In every case a human researcher drove the audit.
- What are the PHP2Shell CVE numbers?
- CVE-2026-109618 (RCE via out-of-memory corruption) and CVE-2026-109619 (RCE via stale global state), both rated 9.2 critical under CVSS v4.0 by PHP.
- Which PHP versions are patched?
- PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, released October 21, 2026. PHP 8.1 and older have no official fixed release.
- How did PHP2Shell leak?
- CVE IDs circulated on October 20, Calif mistakenly published a proof-of-concept video, and Chainguard shipped fixed images early on October 21. AWS saw an exploitation attempt on October 17, before any of that.
Sources
PHP Foundation (2026). Today’s PHP Security Release, and How We’re Strengthening PHP Security. The PHP Foundation. https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
OpenAI (2026). Patch the Planet: global response coordination as agents uncover critical vulnerabilities. OpenAI (vendor post). https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
Austin, R. / Calif (2026). PHP2Shell. Calif (researcher write-up). https://calif.io/php2shell.x/
Tzadik, S., Tamari, S., Ohfeld, N. and Schwartz, T. / Wiz (2026). PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet. Wiz Blog (vendor research). https://www.wiz.io/blog/php2shell-php-rce
Moses, CJ / AWS (2026). Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot. AWS Security Blog. https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
PHP project (2026). RCE via OOM corruption (GHSA-w8hw-w9fx-j79w) and RCE via stale global state (GHSA-6wmf-4rv5-p3rp). GitHub security advisories. https://github.com/php/php-src/security/advisories
OpenAI (2026). php2shell-checker. GitHub. https://github.com/openai/php2shell-checker
Decrypt (2026). Who Found the PHP Bug That Made Governments Unplug Their Websites? ChatGPT, Of Course. Decrypt (news coverage). https://decrypt.co/381567/who-found-php-bug-governments-unplug-websites-chatgpt