Both are grammatically correct, according to standard usage guides, including Pat’s book Woe Is I. So “who’s” is a legitimate contraction of both “who is” and “who has.”

The first thing to figure out when deciding between who’s vs. whose is whether you need one word (whose) or two (who’s). Substitute the words who is, (and then who has) into your sentence. If either substitution works: who’s is your word. Who’s is a contraction of who is or who has.

Just know that “whose” is a possessive noun you’d assign to a single person. But “who’s” is a contraction, usually used in the form of a question, but it can also be used in a statement. Whose: Whose is a possessive pronoun used to indicate ownership or relationship. Who’s: Who’s is a contraction of the words “who is” or “who has.”

"Who’s" is a contraction made up of either “who+is” or “who+has”. The apostrophe in “who’s” stands in for the missing letters of “who+is” or “who+has.” You use “who’s” when you would otherwise be saying “who is” or “who has”.