Companies ainotis Join
My notis
Company

Calif

1 story · first 23 Oct · latest 23 Oct

In the registerCompare with another company
1
stories
19
facts checked
23 Oct
first story
23 Oct
latest

Facts we checked

19

Cloudflare says in its post of 21 October 2026: "The vulnerabilities affect all web servers running PHP 5.4 or later and they may allow an attacker to cause denial of service, remote code execution, and data exposure when an application processes specially crafted HTTP traffic." This differs from PHP's advisories, which give affected ranges only for the 8.2 to 8.5 branches and name no version floor; GHSA-6wmf-4rv5-p3rp gives the confirmed impact as heap use-after-free, memory disclosure and remote code execution. The 5.4 floor matches Calif and Wiz.

The vulnerabilities affect all web servers running PHP 5.4 or later and they may allow an attacker to cause denial of service, remote code execution, and data exposure when an application processes specially crafted HTTP traffic.

Cloudflare deploys protections against php2shell vulnerability · Cloudflare · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Calif recommends as partial mitigations: "For PHP-FPM, disable session upload progress with session.upload_progress.enabled=0 and set memory_limit=-1." and "For mod_php, set memory_limit=-1."

For PHP-FPM , disable session upload progress with session.upload_progress.enabled=0 and set memory_limit=-1 . For mod_php , set memory_limit=-1 . These changes do not replace a patch.

php2shell: a tale of two PHP remote vulnerabilities · Calif · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Show 17 more

Calif says: "PHP-FPM terminates its worker when php_request_startup() fails. Once startup has succeeded, however, an ordinary fatal during script execution follows the normal request-shutdown path, and the worker can accept another request."

PHP-FPM terminates its worker when php_request_startup() fails. Once startup has succeeded, however, an ordinary fatal during script execution follows the normal request-shutdown path, and the worker can accept another request.

php2shell: a tale of two PHP remote vulnerabilities · Calif · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Calif says of PHP-FPM: "This is application-dependent RCE under both Apache mod_php and PHP-FPM. An application exposes the vulnerable transaction through a reachable post-startup decoding operation such as session_start(), session_decode() or unserialize() - including wrappers such as WordPress's maybe_unserialize()." This differs from or adds to other sources: States the application condition for the FPM path as a decoding operation; PHP's advisory says only "a suitable application operation". Calif also says the exploitation paths are "always exploitable under default configurations".

This is application-dependent RCE under both Apache mod_php and PHP-FPM. An application exposes the vulnerable transaction through a reachable post-startup decoding operation such as session_start() , session_decode() or unserialize() - including wrappers such as WordPress’s maybe_unserialize() .

php2shell: a tale of two PHP remote vulnerabilities · Calif · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Calif says of the session upload-progress path: "This results in RCE against arbitrary PHP scripts on Apache mod_php and PHP >= 5.4.0."

This results in RCE against arbitrary PHP scripts on Apache mod_php and PHP >= 5.4.0.

php2shell: a tale of two PHP remote vulnerabilities · Calif · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Calif says of the hash-table bucket path: "This is RCE against arbitrary PHP scripts on Apache mod_php and PHP >= 7.3." This differs from or adds to other sources: A version floor of 7.3 for this path; PHP's advisories name no version floor.

Apache reaches HashTable teardown and interprets the stale bucket, while PHP-FPM discards it with the terminated worker. This is RCE against arbitrary PHP scripts on Apache mod_php and PHP >= 7.3.

php2shell: a tale of two PHP remote vulnerabilities · Calif · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Wiz says: "Wiz Research would like to thank the PHP team, Calif and OpenAI for their work on discovery, coordination and patch verification."

Wiz Research would like to thank the PHP team, Calif and OpenAI for their work on discovery, coordination and patch verification.

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet · Wiz · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Calif’s timeline gives 11 August 2026 as the day Calif reported the first bug to PHP and started coordinated disclosure, and 21 August 2026 as the day it reported the second bug.

2026 — August 11Calif reported the first bug to PHP and started coordinated disclosure process. ... 2026 — August 21Calif reported the second bug to PHP.

php2shell: a tale of two PHP remote vulnerabilities · Calif · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Calif’s timeline gives 1 August 2026 as the day Calif "discovered multiple different paths independently leading to RCE".

2026 — August 1Calif discovered multiple different paths independently leading to RCE that resurfaced the 2024 issues and new trigger points.

php2shell: a tale of two PHP remote vulnerabilities · Calif · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Calif says its PHP audit began after "OpenAI invited us to join its Patch the Planet initiative".

Finally, we arrive in 2026. OpenAI invited us to join its Patch the Planet initiative, and PHP stood out as a high-impact target.

php2shell: a tale of two PHP remote vulnerabilities · Calif · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Calif says: "We were not expecting to find anything critical - everyone and every lab had already done extensive AI assisted audits of this target."

We were not expecting to find anything critical - everyone and every lab had already done extensive AI assisted audits of this target.

php2shell: a tale of two PHP remote vulnerabilities · Calif · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Calif’s write-up describes the AI it used as "my LLM companion" and "our audit buddy" and does not name a model: the strings GPT and Sol do not appear in it, and it does not say which of the two CVEs any AI-assisted finding became.

I asked my LLM companion for help. ... We asked our audit buddy to go over ZendMM allocation behavior, fatal reporting, and request shutdown

php2shell: a tale of two PHP remote vulnerabilities · Calif · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Calif says: "No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery."

No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery.

php2shell: a tale of two PHP remote vulnerabilities · Calif · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Calif says in its write-up that the two vulnerabilities (CVE-2026-109618, CVE-2026-109619) were "discovered by Calif, OpenAI and Wiz".

This story outlines the details of two PHP remote vulnerabilities (CVE-2026-109618, CVE-2026-109619) discovered by Calif, OpenAI and Wiz, and addressed in PHP October 2026 Security Release.

php2shell: a tale of two PHP remote vulnerabilities · Calif · archived copy · checked 23 Oct 2026 · Cite this fact · the story

OpenAI’s Patch the Planet post of 21 October 2026 says Calif "identified a critical flaw using GPT‑5.6 Sol" and refers to it only as a critical flaw; the post gives no CVE number for it, and no CVE number appears anywhere on the page.

Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet initiative, with Wiz also independently discovering and reporting both vulnerabilities.

Patch the Planet: global response coordination as agents uncover critical vulnerabilities · OpenAI · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Calif says it confirmed pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki 1.46.2, Roundcube 1.7.4, Magento 2.4.9, phpMyAdmin 5.2.3, Nextcloud 35.0.1, Laravel 13.11, Symfony 8.1 and WHMCS ("We confirmed pre-auth RCE on the following PHP apps as well as arbitrary PHP scripts in some instances.").

We confirmed pre-auth RCE on the following PHP apps as well as arbitrary PHP scripts in some instances. - WordPress 7.1.2 - Drupal 11.4.3 - Joomla 6.1.4 - MediaWiki 1.46.2 - Roundcube 1.7.4 - Magento 2.4.9 - phpMyAdmin 5.2.3 - Nextcloud 35.0.1 - Laravel 13.11 - Symfony 8.1 - WHMCS

php2shell: a tale of two PHP remote vulnerabilities · Calif · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Calif says of the exploitation paths in its write-up that they "depend on the PHP version and SAPI but are always exploitable under default configurations".

the available exploitation paths depend on the PHP version and SAPI but are always exploitable under default configurations.

php2shell: a tale of two PHP remote vulnerabilities · Calif · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Calif says in its write-up that "The earliest affected path we found dates to PHP 5.4.0".

The earliest affected path we found dates to PHP 5.4.0; the available exploitation paths depend on the PHP version and SAPI but are always exploitable under default configurations.

php2shell: a tale of two PHP remote vulnerabilities · Calif · archived copy · checked 23 Oct 2026 · Cite this fact · the story

OpenAI says Calif identified a critical flaw using GPT-5.6 Sol as part of OpenAI's Patch the Planet initiative, and that Wiz independently discovered and reported both vulnerabilities.

Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet initiative, with Wiz also independently discovering and reporting both vulnerabilities.

Patch the Planet: global response coordination as agents uncover critical vulnerabilities · OpenAI · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Company

Calif

1 story · first 23 Oct · latest 23 Oct

In the register · Compare with another company

Facts we checked

Each fact was checked against the page it links to.

The story

Cases

Ongoing case: Cyber-capable AI models

Built from our published stories and the facts we checked, and kept up to date by them. How we correct.