The race to the first exploit // php2shell
Plays from YouTube in privacy-enhanced mode — nothing loads from YouTube until you press play.
I used Codex and the hints from Calif's public demo to try to rediscover the PHP remote code execution vulnerability behind php2shell. I just wanted to make this video to document an example AI workflow in October 2026. Will be interesting to compare to in the future. LEARN ON HEXTREE (ad) Learn hacking on Hextree: https://www.hextree.io/ Join the Hextree Discord: https://discord.gg/xgQpCQCpvy RESOURCES Calif's php2shell write-up by Ryan Austin: https://calif.io/php2shell/ PHP security advisory and updates (CVE-2026-109618, CVE-2026-109619): https://www.php.net/archive/2026.php#2026-10-21-5…
Description from LiveOverflow.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.