wannabe hacker... he/him 🌱 grow your hacking skills @hextreeio
Internet
Joined March 2015
- Tweets10.3K
- Following1.3K
- Followers164K
- Likes6.6K
If you use AI for "safety", at least do it with some due diligence. This checker is not accurate and will report false positives.
If you are wondering whether your website is affected, we have packaged a Codex skill to help check.
Point your Codex at this repo to guide you through it: github.com/openai/php2shell-…
I am thinking about this a lot and haven't figured it out yet. I have lots of peers that have more success with agents than I have. So far it's not something I can grasp. It seems to be some very small intuitive difference. Like "how to google correctly".
I also wanted to make this video to document an AI/Codex workflow in October 2026. Let's see how different it will be in a few months from now :D
Made a quick video (aka 5h of work), about my experience racing to find php2shell.
youtube.com/watch?v=7CiZmq2l…
of course not remotely exploitable. but maybe there are php "sandboxes" somewhere that rely on this boundary. hence asking
LiveOverflow 🔴 hextree.io retweeted
Omg I found a copy of the original memory_limit advisory. marc.info/?l=bugtraq&m=10898…
probably whispers are going around, and even small unintentional hints could plant the idea to look for it
LiveOverflow 🔴 hextree.io retweeted
To teach a lesson,
After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again.
A big budget can buy a domain. It shouldn't buy someone else's research credit.
If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.
Hack the planet. Credit the researchers.
I think it's useless and wanted to just share PoC. But just in case there is some system running untrusted PHP, I thought I'd better ask.
I don't know the php ecosystem. Is this useful for anything?
This fell off the clanker-train while looking for php2shell
LiveOverflow 🔴 hextree.io retweeted
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac (posted in august)
(related)
8da579ec498d57c20977c8d186d7f6cd4c04f46ffa1b436dd646ec19b99bdf47
cb4c8532c245ff7e05d6e270fca5742bb3271f541ef80f0071ca3d4307eb2b53
957f8cc21b18483f80a9d723aa4f9ded26e456424ffd065a044d1ed9d58a4fbc
4f93976ef105f0d9ff2d60f35d48958c8bba9d9eb2873cd93b3f7105fa4716a6
