Title: PHP2Shell explained — how a PHP vulnerability could lead to RCE without stealing your password
I was researching the recent PHP2Shell vulnerabilities and found the story behind them pretty interesting — especially how the issue was discovered and why authentication wasn’t necessarily the main barrier.
I put together a video breaking down:
what PHP2Shell is
how the vulnerability works at a high level
how it was discovered
the timeline around disclosure
why it matters for PHP developers/server admins
what developers should take away from it
Video: https://youtu.be/JmeYBki6WYY
Would also be interested to hear from people running PHP in production — how quickly do you normally roll out security updates when something like this drops?

[ Removed by Reddit on account of violating the content policy. ]

1) I want use ports but not working: mydomain.com:101/index.html

2) This does work: mydomain.com/php56/index.html

So dev and production environments match want to avoid that subfolder.

--------httpd.conf for #2:------------------------

<VirtualHost *:80> <Directory /var/www/html> Options Indexes FollowSymLinks AllowOverride None Require all granted </Directory> <Location /php82> ProxyPass "unix:/run/php/php8.2-fpm.sock|fcgi://localhost/var/www/html/php82" </Location> <Location /php56> ProxyPass "unix:/run/php/php5.6-fpm.sock|fcgi://localhost/var/www/html/php56" </Location> </VirtualHost> 

--------httpd.conf for #1:------------------------

<VirtualHost *:80> <Directory /var/www/html> Options Indexes FollowSymLinks AllowOverride None Require all granted </Directory> <Location /php82> ProxyPass "unix:/run/php/php8.2-fpm.sock|fcgi://localhost/var/www/html/php82" </Location> </VirtualHost> <VirtualHost *:101> <Directory /var/www/html/php56> Options Indexes FollowSymLinks AllowOverride None Require all granted </Directory> ProxyPass "unix:/run/php/php5.6-fpm.sock|fcgi://localhost/var/www/html/php56" </VirtualHost> 

EDIT: Added Listen 101 and didn't fix anything. See comment with text "AH00526" for details on error from running "apachectl configtest"

Hi,

I've made a demo of sonic the hedgedog in full php ( https://davidnurdin.github.io/php-wasm-sdl/ ) , it execute a php interpreter in the navigator to play with the open source game (https://github.com/davidnurdin/sonicGamePhp) , what do you think about that ? thanks

David

TL;DR for the first 26 hours the page was a static html page being served by php. After the challenger author was informed that if there is no php code php doesn't execute, the author added a phpversion() script.

After this became exploitable it took 2 hours for someone to hack the server and steal the bitcoin.