The race to the first exploit // php2shell
Plays from YouTube in privacy-enhanced mode — nothing loads from YouTube until you press play.
I used Codex and the hints from Calif's public demo to try to rediscover the PHP remote code execution vulnerability behind php2shell. I just wanted to make this video to document an example AI workflow in October 2026. Will be interesting to compare to in the future. LEARN ON HEXTREE (ad) Learn hacking on Hextree: https://www.hextree.io/ Join the Hextree Discord: https://discord.gg/xgQpCQCpvy RESOURCES Calif's php2shell write-up by Ryan Austin: https://calif.io/php2shell/ PHP security advisory and updates (CVE-2026-109618, CVE-2026-109619): https://www.php.net/archive/2026.php#2026-10-21-5…
Description from LiveOverflow.
Explained
The technology and terms in this story. Learn more
- TechnologyPHPA programming language that powers a large share of websites, including WordPress.
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
- WeaknessMemory corruptionBugs that let a program write where it shouldn't in memory, often leading to code execution.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.
