The race to the first exploit // php2shell
I used Codex and the hints from Calif's public demo to try to rediscover the PHP remote code execution vulnerability behind php2shell. I just wanted to make this video to document an example AI workflow in October 2026. Will be interesting to compare to in the future.LEARN ON HEXTREE (ad)
Learn hacking on Hextree: https://www.hextree.io/
Join the Hextree Discord: https://discord.gg/xgQpCQCpvy
RESOURCES
Calif's php2shell write-up by Ryan Austin: https://calif.io/php2shell/
PHP security advisory and updates (CVE-2026-109618, CVE-2026-109619): https://www.php.net/archive/2026.php#2026-10-21-5
CHAPTERS
00:00 - php2shell and the fake exploits
02:54 - Finding clues in Calif's demo
04:29 - Setting up the lab and chasing false leads
06:13 - Pointing Codex at the right PHP code
08:02 - From a fake write-up to a real use-after-free
10:29 - Code execution, but no address leak
11:28 - Patch PHP and know your target
SUPPORT
Per video: https://www.patreon.com/join/liveoverflow
Per month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
Buy my handwriting font (ad): https://shop.liveoverflow.com/
WATCH, FOLLOW & READ
Second channel: https://www.youtube.com/LiveUnderflow
Twitch: https://twitch.tv/LiveOverflow/
Twitter: https://twitter.com/LiveOverflow/
Instagram: https://instagram.com/LiveOverflow/
TikTok: https://www.tiktok.com/@liveoverflow_
LiveOverflow blog: https://liveoverflow.com/
Hextree blog (ad): https://www.hextree.io/blog
#PHP #VulnerabilityResearch #LiveOverflow
(ad) LiveOverflow YouTube channel is supported by advertisement and product placement. Receive SMS online on sms24.me
TubeReader video aggregator is a website that collects and organizes online videos from the YouTube source. Video aggregation is done for different purposes, and TubeReader take different approaches to achieve their purpose.
Our try to collect videos of high quality or interest for visitors to view; the collection may be made by editors or may be based on community votes.
Another method is to base the collection on those videos most viewed, either at the aggregator site or at various popular video hosting sites.
TubeReader site exists to allow users to collect their own sets of videos, for personal use as well as for browsing and viewing by others; TubeReader can develop online communities around video sharing.
Our site allow users to create a personalized video playlist, for personal use as well as for browsing and viewing by others.
@YouTubeReaderBot allows you to subscribe to Youtube channels.
By using @YouTubeReaderBot Bot you agree with YouTube Terms of Service.
Use the @YouTubeReaderBot telegram bot to be the first to be notified when new videos are released on your favorite channels.
Look for new videos or channels and share them with your friends.
You can start using our bot from this video, subscribe now to The race to the first exploit // php2shell
What is YouTube?
YouTube is a free video sharing website that makes it easy to watch online videos. You can even create and upload your own videos to share with others. Originally created in 2005, YouTube is now one of the most popular sites on the Web, with visitors watching around 6 billion hours of video every month.
![방향 잃은 코스피…앞으로 3주가 고비, 시장 대응 전략은? | 박병창 MP파트너스 대표 [마켓 인사이드]](https://img.youtube.com/vi/_lnx0OrZydU/maxresdefault.jpg)
![[LIVESTREAM] Majelis Ta'lim Al - Husna | TGH. M. Rasyid Ridha | Kamis, 22 Oktober 2026](https://img.youtube.com/vi/V2L9G9CY1DI/maxresdefault.jpg)