The race to the first exploit // php2shell

I used Codex and the hints from Calif's public demo to try to rediscover the PHP remote code execution vulnerability behind php2shell. I just wanted to make this video to document an example AI workflow in October 2026. Will be interesting to compare to in the future. LEARN ON HEXTREE (ad) Learn hacking on Hextree: https://www.hextree.io/ Join the Hextree Discord: https://discord.gg/xgQpCQCpvy RESOURCES Calif's php2shell write-up by Ryan Austin: https://calif.io/php2shell/ PHP security advisory and updates (CVE-2026-109618, CVE-2026-109619): https://www.php.net/archive/2026.php#2026-10-21-5 CHAPTERS 00:00 - php2shell and the fake exploits 02:54 - Finding clues in Calif's demo 04:29 - Setting up the lab and chasing false leads 06:13 - Pointing Codex at the right PHP code 08:02 - From a fake write-up to a real use-after-free 10:29 - Code execution, but no address leak 11:28 - Patch PHP and know your target SUPPORT Per video: https://www.patreon.com/join/liveoverflow Per month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join Buy my handwriting font (ad): https://shop.liveoverflow.com/ WATCH, FOLLOW & READ Second channel: https://www.youtube.com/LiveUnderflow Twitch: https://twitch.tv/LiveOverflow/ Twitter: https://twitter.com/LiveOverflow/ Instagram: https://instagram.com/LiveOverflow/ TikTok: https://www.tiktok.com/@liveoverflow_ LiveOverflow blog: https://liveoverflow.com/ Hextree blog (ad): https://www.hextree.io/blog #PHP2SHELL #LiveOverflow (ad) LiveOverflow YouTube channel is supported by advertisement and product placement.