Project Glasswing and PHP2Shell vulnerability
Last week many sites went offline to apply patches to PHP interpreters to provide protection from a recently found vulnerability named PHP2Shell.
OpenAI and Wiz claim credit for finding PHP2Shell. It appears that so-called "artificial intelligence" has scored another victory, at least in the public relations arena. However, the vulnerability escaped the attention of another major project which had been specifically established to hunt security issues:
What is Project GlasswingProject Glasswing is an initiative to secure the world's most critical software for the AI era.
https://www.anthropic.com/project/glasswing
The PHP interpreter quite obviously is "most critical software". This leads to the question: Why couldn't Claude Mythos find PHP2Shell?
With PHP so widely used millions of lines of PHP code must have been provided by Glasswing member organizations for scanning.
Because PHP interpreter source code is freely accessible to the public Claude Mythos can examine it without Glasswing making the PHP maintainer group a member.
As I reported in an earlier message to this list, Anthropic issued a summarized report on May 22. Since then the following page has been updated to reflect recent findings:
Anthropic's coordinated vulnerability disclosure dashboard https://red.anthropic.com/2026/cvd/
Last updated October 2 2026.
The Anthropic Glasswing Receipts Are Starting to Trickle In Blog | VulnCheck
Patrick Garrity September 8, 2026Anthropic Project Glasswing Findings
Anthropic's Project Glasswing is approaching 5 months old, and Anthropic published its Vulnerability Disclosure Ledger on May 22nd. It hadn't received an update until this past week, when it backfilled the ledger with additional findings and updates, so naturally I thought it would be worthwhile to take a look at the receipts.
Anthropic-linked CVEs pile up, attackers mostly shrug
What is PHP and how serious is the computer language flaw causing website shutdowns? - The Guardian
Some on social media have also pointed to a prescient cartoon by Randall Munroe, who is behind the web comic XKCD, about the reliance of modern infrastructure on projects maintained by small groups or one person.The PHP Foundation operates on financial contributions and maintains the language with only 13 full-time and part-time engineers, compared to the billions invested into developing AI.
Akira Urushibata █