Calif
AI overview
Sign in and the AI will write an overview from our coverage.
Headlines · 15
- Wiz CTO Says AI Helped Discover Critical PHP Vulnerabilities
TechCrunch AI’s Equity podcast reports that Wiz CTO Tomer Schwartz said AI and custom tooling tested dozens of ideas over a weekend and were necessary for his team to find two critical PHP vulnerabilities. The bugs prompted organizations to patch systems, with some taking sites offline; researchers also warned that AI may accelerate the discovery and exploitation of new vulnerabilities.
TechCrunch AI · 🔥 0 - AI-Assisted Discovery of PHP2Shell Vulnerabilities Followed by Mass Exploitation Attempts
On October 21, two remote-code-execution vulnerabilities in PHP, each scored 9.2 under CVSS, were disclosed. Both allowed unauthenticated attackers to execute arbitrary code. The report says researchers from Wiz, Calif, and OpenAI used AI to find the flaws. Chainguard’s CEO separately said the company’s AI Harness and a frontier model discovered the same class of memory-corruption vulnerabilities. The PHP project moved up its patch release by one day, while government and public-sector agencies took protective measures. Cloudflare CEO Matthew Prince said the company observed thousands of exploitation attempts in the 10 hours before public disclosure, tens of thousands within 45 minutes afterward, and hundreds of thousands within two hours.
InfoQ 中文 AI&大模型 · 🔥 0 - Honeypot captures first reported PHP2Shell exploitation
Perplexity researcher Adel Karimi said six honeypot sensors detected PHP2Shell exploitation between 19:26 and 19:31 UTC on October 24. In a honeypot running PHP 8.4.26 with Apache mod_php, attackers launched /bin/sh and executed 35 shell processes through a four-stage attack involving memory pressure, an oversized PHPSESSID cookie, and adjustment of the final request using obtained memory addresses. The PHP development team patched CVE-2026-109618 and CVE-2026-109619, while Wiz and Calif said AI assistance helped them find the unusually destructive vulnerabilities.
iThome 台湾 · 🔥 0 - CISA reports active exploitation of two critical PHP flaws
IT Home reported that the US Cybersecurity and Infrastructure Security Agency confirmed active exploitation of two critical vulnerabilities in PHP web software and ordered US federal civilian agencies to patch affected systems within three days. PHP maintainers released fixes shortly before the warning. Security researchers had reported finding evidence of real-world exploitation, while Calif researchers separately said they used an AI model to devise a method for exploiting the vulnerabilities. CISA did not identify the specific organizations or systems targeted, and the report did not establish that the observed attacks used the AI-assisted method.
IT之家 AI · 🔥 0 - GPT-5.6 Sol Reportedly Found Two PHP RCE Vulnerabilities
TMTPost reports that Calif's Ryan Austin used GPT-5.6 Sol to identify two remote-code-execution vulnerabilities in PHP core memory handling on August 11, followed by independent rediscoveries from Wiz, OpenAI, and Chainguard. PHP released a patch on October 21 with an official severity rating of 9.2, while a security vendor estimated that roughly two million exposed servers were online and 99.99% had not yet applied the patch at that time.
钛媒体 · 🔥 0 - PHP Foundation has one full-time employee amid security strain
PHP Foundation Executive Director Elizabeth Barron said the nonprofit has one full-time employee, 14 mostly part-time contractors and an unpaid volunteer board, relying on donations and grants. Reports say the foundation worked with OpenAI, Wiz and Calif on two high-risk vulnerabilities, while Cloudflare detected millions of attack attempts; Barron said there was no evidence of successful exploitation before disclosure or against patched systems. AI-assisted research helped uncover vulnerabilities, but code proposals nearly doubled without a corresponding increase in contributors, adding review work for maintainers.
cnBeta · 🔥 0 - Frontier AI Models Used in Reported PHP RCE Exploit Development
A report says security teams from Calif and Wiz used frontier AI models to find two PHP remote-code-execution vulnerabilities and build exploits. The flaws, CVE-2026-109618 and CVE-2026-109619, are marketed as PHP2Shell. The report says a 2024 PHP Foundation audit had identified CVE-2026-109618 but could not determine how to create an exploit from the theoretical issue or agree on a fix. It cites an estimate that PHP2Shell could affect as much as 70% of the internet, including thousands of major websites, though the report does not substantiate that estimate. There is also disagreement over whether working exploit attempts occurred before the patch was released.
Hacker News 首页（100+ 分） · 🔥 0 - AI-Assisted Discovery Turns PHP2Shell Into a Critical Crisis
The PHP development team patched CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, on October 21. According to iThome 台湾, Calif researchers used frontier AI tools alongside human expertise to connect previously reported memory-exhaustion and cleanup weaknesses with reliable remote-code-execution paths affecting WordPress, mod_php, and PHP-FPM. WIRED AI reported that Cloudflare counted millions of exploitation attempts shortly after disclosure, while the PHP Foundation said it had not observed any successful exploitation.
iThome 台湾 · 🔥 0 - AI Models Helped Discover PHP2Shell Vulnerabilities
Wiz researchers said they used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol to identify two PHP vulnerabilities in late August, then validated them in Drupal and WordPress before reporting them to the PHP development team. The flaws date back at least to PHP 5.4, released in 2012. PHP subsequently released patches for the two vulnerabilities, both rated critical under CVSS v4.0. Accounts differ on whether exploitation occurred before disclosure: Amazon said it first detected activity on October 17, while CISA said it had not observed exploitation.
iThome 台湾 · 🔥 0 - GPT-5.6 Sol helped find two critical PHP flaws, now patched
The Rundown AI reported that OpenAI's GPT-5.6 Sol helped researchers identify two critical flaws in PHP, the language behind roughly 70% of websites, and that PHP maintainers have now released patches. The newsletter said security firm Calif found the first bug on Aug. 1 using GPT-5.6 Sol, while Google-owned Wiz separately caught both flaws weeks later with Sol and Gemini 4 Argon. According to the report, OpenAI said it worked with PHP maintainers on patches for two months and called the find one of the most impactful security issues in recent memory; the NSA urged organizations unable to patch to take systems offline, and Cloudflare said it was seeing early attacks.
The Rundown AI · 🔥 0 - AI-found PHP2Shell flaws under mass exploitation as PHP ships emergency patches
PHP released versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on October 21 to fix two memory flaws collectively called PHP2Shell, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0. The PHP Foundation said security firm Calif used OpenAI's GPT-5.6 Sol on August 11 to confirm the bugs could yield unauthenticated remote code execution, while Wiz independently found the first flaw using Gemini 4 Argon and GPT-5.6 Sol. Hadrian reported mass exploitation attempts, mainly through PHP's session upload-progress mechanism, about two and a half hours before the patches appeared, and Amazon said attackers tried to exploit the flaws four days before public disclosure.
iThome 台湾 · 🔥 0 - OpenAI releases Codex skill to check sites for PHP2Shell vulnerabilities
OpenAI released a Codex skill that helps website operators check whether their PHP deployments may be affected by the critical flaws CVE-2026-109618 and CVE-2026-109619, both scored 9.2 under CVSS v4.0. The PHP Foundation issued fixes on October 21, while Amazon later reported that the vulnerabilities were being broadly exploited in the wild. OpenAI credits its models with assisting researchers, although Calif researcher Ryan Austin disputed the claim that a model was the first discoverer of the initial exploit path.
OpenAI (X) · 🔥 0 - PHP2Shell Flaws Trigger Emergency Patches and Widespread Shutdowns
PHP released fixes for two critical, unauthenticated remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Government, hospital, university and commercial services in Europe and Asia were temporarily taken offline while operators patched, after reports of early exploitation. OpenAI said GPT-5.6 Sol helped researchers identify the flaws, although agencies differed on whether exploitation had been confirmed.
The Next Web · 🔥 0 - PHP2Shell: critical PHP flaws patched after AI-assisted discovery
Wiz Research disclosed two critical vulnerabilities in core PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, involving memory disclosure and unauthenticated remote code execution; Wiz says every PHP version released in the last decade, back to 5.4, is affected. PHP released patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026, with both flaws rated CVSS 9.2, while OpenAI said it coordinated with PHP maintainers, Wiz, Cloudflare and others over roughly two months. OpenAI said Calif researcher Ryan Austin identified a critical flaw using GPT-5.6 Sol under its Patch the Planet initiative, with Wiz independently discovering and reporting both flaws; Calif later said Austin was the first to find and exploit the flaw, with AI compressing verification rather than supplying direction.
Hacker News · AI（100+ 分） · 🔥 0 - Paper proposes CALIF to curb reward hacking in verifiable instruction following
An arXiv paper submitted on 14 October, "Diagnosing and Correcting Reward Hacking in Verifiable Instruction Following," argues that verifiable instruction-following benchmarks emphasize output-constraint satisfaction and can overlook whether a response actually answers the underlying request, creating an evaluation blind spot; the authors report that frontier models can receive full credit for responses with little substantive answer content. They also report that using the same verifier-based criterion as a training reward can induce reward hacking, with publicly released checkpoints showing higher constraint satisfaction but lower response quality after reinforcement learning with verifiable rewards. To address this, they introduce CALIF, a lightweight method that adds a calibrated likelihood-based bonus to verifier rewards, computed with the existing frozen reference policy and requiring no additional judge or learned reward model; across 1.7B to 8B models in reasoning and non-reasoning modes, they report improved IFBench constraint satisfaction with response quality near or above pre-RL levels.
Hugging Face · Papers · 🔥 0
Experience and discussion from the community
Share my Calif experienceAsk about Calif
Nobody has shared their experience with Calif yet.