Unverified50% confidenceEventExact time
The PHP Foundation blog states that at about 20:00 UTC after the pre-announcement was published, the security company Calif mistakenly made public a proof-of-concept video that demonstrated the exploitation process against multiple targets and revealed a small amount of additional vulnerability detail.
1
Sources
50%
Confidence
Long-term
Relevance
10/21/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedAccording to the timeline disclosed on Wiz's official blog: the first vulnerability was discovered on August 19, the exploitability of unauthenticated RCE on Drupal and WordPress was confirmed on August 20 and 21 respectively, and it was reported to the PHP security team on August 24.63% similarUnverifiedThe PHP Foundation released a round of security updates and published a post explaining how the team is systematically strengthening PHP's security capabilities.61% similarUnverifiedThe PHP official team announced through its announcement channel that a security release characterized as "critical" is about to be released.60% similarUnverifiedThis time the PHP Foundation merged the patch notes with the security roadmap into a single release, adding governance-level context beyond the CVE information.59% similarUnverifiedThe target website used in the demonstration has deployed a security verification mechanism similar to Cloudflare, which the author describes as a budget version of the 5-second shield.59% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1082894API
curl https://kongchang.com/api/v1/knowledge/claims/1082894MCP
get_claim(id=1082894)