If I understood the timeline correctly, there was an announcement made somewhere that an RCE would be announce w/ a patch, and the internet just scanned the entire codebase, they really fumbled this for the sake of having a PR post for OpenAI.

On the other hand, I don't mind AI companies doing this sort of thing, I'm sure a lot of our internet infrastructure could benefit from these sorts of fixes and changes.

After the HN post came up, one security firm included "session.upload_progress.enabled", "session.use_strict_mode", and "php-fpm" in the SEO tags for their initial disclosure that a vulnerability existed. I imagine this was a good hint. https://web.archive.org/web/20261021005246/https://sansec.io... https://x.com/its5q/status/2112700519261032497

The somewhere was a loser on this very website https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/