Watch · Hacking and CTFs
The race to the first exploit // php2shell
The Brief
- The creator used Codex with hints from Calif's public demo to try to rediscover the PHP remote code execution vulnerability behind php2shell.
- The video documents an example AI-assisted vulnerability research workflow, set in October 2026.
- Chapters cover setting up a lab, chasing false leads, pointing Codex at relevant PHP code, and moving from a fake write-up to a real use-after-free.
- It also covers code execution without an address leak, and patching PHP and knowing the target.
- The description links Calif's php2shell write-up and the PHP security advisory for CVE-2026-109618 and CVE-2026-109619.
Why watch · It shows a concrete, step-by-step case of an AI coding agent being used to reproduce a real PHP exploit, which is useful for comparing AI-assisted security research over time.
- PHP
- php2shell
- Codex
- CVE-2026-109618
- Use-after-free
Summarised by Claude from the video’s title and description – YouTube doesn’t make transcripts available, so check the video for the details.
Chapters
Show the full video description ›Hide the video description
I used Codex and the hints from Calif's public demo to try to rediscover the PHP remote code execution vulnerability behind php2shell. I just wanted to make this video to document an example AI workflow in October 2026. Will be interesting to compare to in the future. LEARN ON HEXTREE (ad) Learn hacking on Hextree: https://www.hextree.io/ Join the Hextree Discord: https://discord.gg/xgQpCQCpvy RESOURCES Calif's php2shell write-up by Ryan Austin: https://calif.io/php2shell/ PHP security advisory and updates (CVE-2026-109618, CVE-2026-109619): https://www.php.net/archive/2026.php#2026-10-21-5 CHAPTERS 00:00 - php2shell and the fake exploits 02:54 - Finding clues in Calif's demo 04:29 - Setting up the lab and chasing false leads 06:13 - Pointing Codex at the right PHP code 08:02 - From a fake write-up to a real use-after-free 10:29 - Code execution, but no address leak 11:28 - Patch PHP and know your target SUPPORT Per video: https://www.patreon.com/join/liveoverflow Per month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join Buy my handwriting font (ad): https://shop.liveoverflow.com/ WATCH, FOLLOW & READ Second channel: https://www.youtube.com/LiveUnderflow Twitch: https://twitch.tv/LiveOverflow/ Twitter: https://twitter.com/LiveOverflow/ Instagram: https://instagram.com/LiveOverflow/ TikTok: https://www.tiktok.com/@liveoverflow_ LiveOverflow blog: https://liveoverflow.com/ Hextree blog (ad): https://www.hextree.io/blog #PHP2SHELL #LiveOverflow (ad) LiveOverflow YouTube channel is supported by advertisement and product placement.
