Title: PHP2Shell explained — how a PHP vulnerability could lead to RCE without stealing your password
I was researching the recent PHP2Shell vulnerabilities and found the story behind them pretty interesting — especially how the issue was discovered and why authentication wasn’t necessarily the main barrier.
I put together a video breaking down:
what PHP2Shell is
how the vulnerability works at a high level
how it was discovered
the timeline around disclosure
why it matters for PHP developers/server admins
what developers should take away from it
Video: https://youtu.be/JmeYBki6WYY
Would also be interested to hear from people running PHP in production — how quickly do you normally roll out security updates when something like this drops?