LiveOverflow: The race to the first exploit // php2shell

I used Codex and the hints from Calif's public demo to try to rediscover the PHP remote code execution vulnerability behind php2shell. I just wanted to make this video to document an example AI workflow in October 2026. Will be interesting to compare to in the future.



LEARN ON HEXTREE (ad)

Learn hacking on Hextree: https://www.hextree.io/

Join the Hextree Discord: https://discord.gg/xgQpCQCpvy



RESOURCES

Calif's php2shell write-up by Ryan Austin: https://calif.io/php2shell/

PHP security advisory and updates (CVE-2026-109618, CVE-2026-109619): https://www.php.net/archive/2026.php#2026-10-21-5



CHAPTERS

00:00 - php2shell and the fake exploits

02:54 - Finding clues in Calif's demo

04:29 - Setting up the lab and chasing false leads

06:13 - Pointing Codex at the right PHP code

08:02 - From a fake write-up to a real use-after-free

10:29 - Code execution, but no address leak

11:28 - Patch PHP and know your target



SUPPORT

Per video: https://www.patreon.com/join/liveoverflow

Per month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join

Buy my handwriting font (ad): https://shop.liveoverflow.com/



WATCH, FOLLOW & READ

Second channel: https://www.youtube.com/LiveUnderflow

Twitch: https://twitch.tv/LiveOverflow/

Twitter: https://twitter.com/LiveOverflow/

Instagram: https://instagram.com/LiveOverflow/

TikTok: https://www.tiktok.com/@liveoverflow_

LiveOverflow blog: https://liveoverflow.com/

Hextree blog (ad): https://www.hextree.io/blog



#PHP #VulnerabilityResearch #LiveOverflow



(ad) LiveOverflow YouTube channel is supported by advertisement and product placement.