I feel like all "non-inner-circle people" here are taken for a laugh. OpenAI and these security companies sat on this for 2 months, decided for themselves who gets access to an early fix, and then leave the rest out to dry while they failed to properly contain it.

The official interim fix for php8.5 [1] could have been published 24h ago, or even 2 weeks ago, without revealing any security details. Specifically once the POC came online. Would have been significantly more useful than these polished blogs.

Perhaps I'm missing something here, but the costs (dev/sre time, missed sales, potential data leaks and hacks) of the way that this was handled is significant.

[1] https://github.com/php/php-src/security/advisories/GHSA-6wmf...

> Over the past two months, we led a coalition of maintainers, researchers, and security providers to address critical vulnerabilities in PHP, an open-source programming language used to run websites and web applications.

And they botched this as someone talked. To me this looks like they used this for a PR stunt and aimed for an RCE.

surprising it took nearly a month to acknowledge the bug

August 24, 2026: Wiz Research reports the vulnerabilities to the PHP security team.

September 21, 2026: PHP acknowledges the reports and begins developing a coordinated fix.

So how does the exploit actually work? The best I can find is that they manage to use the corrupted generic decoder state to write a single pointer and associated PHP type information anywhere in memory, then immediately claim "this is RCE". Is that enough? From my (admittedly limited) understanding of such things, after writing code to the target memory you also need to be able to start actually running it. Or do they overwrite the PHP code (which is somewhere in memory) and then let the interpreter do its thing?

Wiz Khalif AI

Why is WordPress out of that list? Isn't it the single major PHP installation in the whole Internet across hosted and self-hosted instances?

WizCalif.. dude xD

> https://www.php2shell.com/

Boy, do I hate these PR websites masquerading as vulnerability reports. It's slop all the way down with these companies.

Do they consider this an example of a "good" response?

Yet it was leaked and I can't see a single "Here's this piece of code you can run to validate the fix actually works"

It's like slop for infosec markters

[dead]

Thank you, Wiz Khalifa.