Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ Over the last months the way PHP security work is organized has changed consider

Earlier this year, we worked with [Alpha-Omega](https://alpha-omega.dev/) to scan PHP with Anthropic's Claude Mythos. But since the Mythos scan, we have added other tools, including OpenAI's Daybreak Red for validating reports and exploits, alongside sanitizer builds and reproduction environments that match our CI on every platform PHP supports.

The PHP Foundation got the PHP project into the [Patch the Planet](https://openai.com/index/patch-the-planet/) program, as part of which security firm [Calif](https://calif.io/) began an audit of PHP on July 30th, 2026\. On August 11th researcher Ryan A at Calif reported an unconditional remote code execution with the same root cause as the OOM problem we had found in 2024\. [OpenAI](https://openai.com/) independently reported the same root cause on the same day, followed by further attack vectors from OpenAI on September 18th and from [Wiz](https://www.wiz.io/) on August 24th. More recently, [Trail of Bits](https://trailofbits.com/) has also been auditing PHP. The reports from Calif, OpenAI, and Wiz made the full impact of the OOM problem clear, and from August 11th onward, fixing it became the top priority for all of the PHP Foundation's team working on security. Without the Foundation’s funding it would have been impossible to have multiple people work on this issue full time, eventually through weekends and around the clock to coordinate and communicate with other involved parties.
The PHP Foundation got the PHP project into the [Patch the Planet](https://openai.com/index/patch-the-planet/) program, as part of which security firm [Calif](https://calif.io/) began an audit of PHP on July 30th, 2026. On August 11th, researcher Ryan A at Calif reported an unconditional remote code execution with the same root cause as the OOM problem we had found in 2024. [OpenAI](https://openai.com/) independently reported the same root cause, followed by further attack vectors from OpenAI on September 18th and from [Wiz](https://www.wiz.io/) on August 24th. More recently, [Trail of Bits](https://trailofbits.com/) has also been auditing PHP. The reports from Calif, OpenAI, and Wiz made the full impact of the OOM problem clear, and from August 11th onward, fixing it became the top priority for all of the PHP Foundation's team working on security. Without the Foundation’s funding it would have been impossible to have multiple people work on this issue full time, eventually through weekends and around the clock to coordinate and communicate with other involved parties.

The growth of AI-assisted research also means the PHP security team receives far more reports than before. As Alexandre Daubois described last week in [How the PHP Security Team Handles Your Reports](https://thephp.foundation/blog/2026/10/14/how-the-php-security-team-handles-your-reports/), the team has published 15 CVEs since July 1st and worked through more than 100 reports that turned out to be invalid, duplicates, or not reproducible. AI helps the team validate reports and group reports sharing the same root cause, but a person makes every call and works on every patch.

Expand Down
Loading