Top all-time · #2552
Calif Newsletter
Company blog · calif.io/researchsecurity
Calif Newsletter is the company blog at calif.io, writing about security. Since 2026, 30 different Hacker News readers have linked it 34 times, most often “CVE-2026-86950: An in-the-wild iOS bug with a possible WhatsApp zero-click path”. It is still writing: the last post was on 2026-10-16, and you can follow it by feed.
Too few sampled comments (18) to say how often HN recommends it.?
Why HN links it
HN readers link Calif's security research blog for its write-ups on the PHP2Shell remote code execution bug, plus its iOS and WeChat exploit research. One commenter calls its PHP2Shell write-up the most detailed.
Summarised by Claude from a sample of 18 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Calif secures the AI you use every day. Red teaming and security engineering from the hackers trusted by OpenAI, Anthropic, Google, Cursor and xAI.
Most-linked posts?
- /php2shell/7 people · 9 mentions · first linked 2026-10-21
- CVE-2026-86950: An in-the-wild iOS bug with a possible WhatsApp zero-click path5 people · 6 mentions · first linked 2026-09-30
- WeWorm: Zero-Click WeChat Worm5 people · 5 mentions · first linked 2026-09-08
- /php2shell/4 people · 4 mentions · first linked 2026-10-21
- A tale of two PHP remote vulnerabilities3 people · 3 mentions · first linked 2026-10-21
- OEMpocalypse: Unprivileged Android app to root on Samsung, Xiaomi, others2 people · 2 mentions · first linked 2026-09-05
What Hacker News says?
Cool to see our work here. I'm Thai, and I run Calif. Happy to answer any questions. We'll publish the technical details of these hacks over the coming weeks. Writing these articles takes time, and we've been busy with a PHP thing [1]. In the meantime, check out The Great Glyph Grift [2] for a glimpse of what can go wrong when iOS parses PDFs. Just in case you wonder, we've disclosed most of the bugs in these exploi…
Comment linking /research/the-great-glyph-grift
on “Today, we hacked what we'd set out to hack: the iPhone”Submitted Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD as a story · 196 points
HN discussionCheck out https://calif.io/research/the-great-glyph-grift , which shows one could go wrong with PDF in iOS. We're gonna publish more in the coming weeks. Writing these blog posts take time, and we've been busy with another PHP thing.
Comment linking /research/the-great-glyph-grift
on “Today, we hacked what we'd set out to hack: the iPhone”Submitted OEMpocalypse: Unprivileged Android app to root on Samsung, Xiaomi, others as a story · 104 points
HN discussion> Looking at the PHP bug tracker the specific bugs were fixed. So my best guess is that the LLM was able to find alternative variants that still worked? In the link from the comment to which you replied, buried deep below the comic strips and all that, there is this explanation which seems to confirm your guess: > Right. We should explain from the start. My first step of finding if any long-lost siblings of Stefan's…
Comment linking /php2shell/
on “PHP 8.2.35”Submitted WeWorm: Zero-Click WeChat Worm as a story · 37 points
HN discussionAccording to this post, one of the researchers was a former PHP security lead who already knew about the bug since 2004. So I'd assume they would be taken as credible by the current team https://calif.io/php2shell/
Comment linking /php2shell/
on “PHP 8.2.35”Submitted The first zero-click worm to spread through WeChat calls across iOS and Android as a story · 8 points
HN discussionLooks like a co-ordinated disclosure between Wiz, Calif and OpenAI: https://www.php2shell.com/ https://www.wiz.io/blog/php2shell-php-rce https://calif.io/php2shell/ https://openai.com/index/coordinated-disclosure-of-critical-... (not yet live) https://thephp.foundation/blog/2026/10/21/todays-php-securit... (not yet live)
Comment linking /php2shell/
on “PHP 8.2.35”Submitted WeWorm as a story · 7 points
HN discussionThe company, Calif, has it with the music, effects and Ui Shigure animation on their own website and youtube channel: https://calif.io/php2shell/#php-5-4-0-rce
Comment linking /php2shell/
on “Today's PHP security release, and how we're strengthening security”Submitted A tale of two PHP remote vulnerabilities as a story · 3 points
HN discussionUnbelievably the anime girl video was the official version from Calif. https://calif.io/php2shell/#php-5-4-0-rce
Comment linking /php2shell/
on “Today's PHP security release, and how we're strengthening security”Submitted CVE-2026-86950: The Great Glyph Grift as a story · 2 points
HN discussionIt's Calif. They're named in the post. > As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms that had reported the issues mistakenly published a video. It showed their proof of concept working against a number of targets and revealed a few additional, though limited, details about the vulnerabilities. You can see the same demo video on their site: https://calif.io/php2shel…
Comment linking /php2shell/
on “Today's PHP security release, and how we're strengthening security”Submitted CVE-2026-86950: An in-the-wild iOS bug with a possible WhatsApp zero-click path as a story · 2 points
HN discussionWiz (subsidiary of google) claims to have a working exploit: https://www.wiz.io/blog/php2shell-php-rce . Calif has as well: https://calif.io/php2shell/ . Calif even posted a video demonstrating the exploit (subsequently removed)
Comment linking /php2shell/
on “There isn't an easy exploit for this PHP vulnerability”Submitted WeWorm: The first zero-click worm to spread through WeChat calls as a story · 2 points
HN discussionWiz: "These vulnerabilities include memory disclosure and unauthenticated remote code execution in PHP itself, independent of the application running on top of it"[1] Calif: "the available exploitation paths depend on the PHP version and SAPI but are always exploitable under default configurations" ... "This results in RCE against arbitrary PHP scripts on Apache mod_php and PHP >= 5.4.0."[2] PHP Foundation: "full re…
Comment linking /php2shell/
on “There isn't an easy exploit for this PHP vulnerability”Submitted OEMpocalypse Now: A Generic Android Exploitation Strategy as a story · 2 points
HN discussionThere are multiple write-ups on how the vulnerability works. The Calif one is the most detailed. Also, no one used Claude. There's a whole world of information out there when you read the original sources instead of social media distortions. https://calif.io/php2shell/ https://www.wiz.io/blog/php2shell-php-rce
Comment linking /php2shell/
on “There isn't an easy exploit for this PHP vulnerability”Submitted A tale of two PHP remote vulnerabilities as a story · 1 points
HN discussionWhat kind of pisses me off was that there were kind of two sides of the continuum. You've got the detailed technical writeup on one end in the patches themselves, and on the other end you've essentially got the AI and security companies both together (php2shell) and independently with their highly polished microsites and blog posts with attractive infographics and stylized pitch deck looking images. Every publicatio…
Comment linking /php2shell/
on “There isn't an easy exploit for this PHP vulnerability”Submitted A tale of two PHP remote vulnerabilities as a story · 1 points
HN discussion> So why was everyone so scared? > Because: […] > 3. The exploit video had an anime girl in it Lol, somehow I had missed this. Since I had to dig a bit for it, here it is for everyone’s enjoyment: https://www.youtube.com/watch?v=pfWZrdzvooc (via https://calif.io/php2shell/#php-5-4-0-rce )
Comment linking /php2shell/
on “There isn't an easy exploit for this PHP vulnerability”Submitted An in-the-wild iOS bug with a possible WhatsApp zero-click path as a story · 1 points
HN discussionSeems to have been prompted from research by calif.io who started disclosure on August 11 vs Wiz on August 24th? A bit unclear on the participants and how they all interacted... https://calif.io/php2shell/
Comment linking /php2shell/
on “PHP2Shell: AI uncovers critical RCE in PHP”It seems like OpenAI are trying to frame this as if AI did all the work here, but it's not really true given what Calif say ( https://calif.io/php2shell/ ): > How did we find this? > No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery. I focused on something I had a background in, knew its vulnerability history well, and held a theory that speci…
Comment linking /php2shell/
on “Patch the Planet: global response coordination as agents uncover vulnerabilities”Yes, the actual bug was known before, but LLMs undoubtedly surfaced the impact: https://tolmo.com/blog/faster-than-anyone-can-fix-them/ What the PHP2Shell discoverer said on finding the issue: https://calif.io/php2shell/ > No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery. I focused on something I had a background in, knew its vulnerability hi…
Comment linking /php2shell/
on “Is this the new cyber normal?”Which companies? The earliest claim of an exploit attempt in the wild I had heard was October 17th, and that was “extant”, not “rampant”. I don’t suppose you’re thinking of when the issue was discovered ? That was August 1st, according to https://calif.io/php2shell/#the-discovery .
Comment linking /php2shell/
on “PHP2Shell: Exploitation attempts and remediation trends”
