Framing the php2shell story as "AI uncovered php2shell" is like hearing an awesome song and crediting the guitar instead of the player. It's just incorrect and steals credit from a good researcher.
The underlying bug was discovered in 2020, a related one in 2024, and they were both rediscovered again through exploitation in 2026 by a human researcher. The researcher used LLM tech to help with parts of the process, not all of it, and says so in the writeup.
https://calif.io/php2shell/
Jimmy Wylie
npub1vp…7jymq
2026-10-22 17:11:30 UTC
Author Public Key
npub1vpwq9q3yyk3m37mluzdzplyapksasr8gl7g2qfqt0c7y5m27ggas97jymqPublished at
2026-10-22 17:11:30 UTCEvent JSON
{
"id": "23172fa4b656354b912f2f1fcd33b1cacb7587b87d5ae8638e308edeb1b3a927",
"pubkey": "605c02822425a3b8fb7fe09a20fc9d0da1d80ce8ff90a0240b7e3c4a6d5e423b",
"created_at": 1792689090,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@mayahustle/117485672263060599",
"web"
],
[
"proxy",
"https://infosec.exchange/users/mayahustle/statuses/117485672263060599",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/mayahustle/statuses/117485672263060599",
"pink.momostr"
],
[
"-"
]
],
"content": "Framing the php2shell story as \"AI uncovered php2shell\" is like hearing an awesome song and crediting the guitar instead of the player. It's just incorrect and steals credit from a good researcher.\n\nThe underlying bug was discovered in 2020, a related one in 2024, and they were both rediscovered again through exploitation in 2026 by a human researcher. The researcher used LLM tech to help with parts of the process, not all of it, and says so in the writeup.\n\nhttps://calif.io/php2shell/",
"sig": "a790323fb56d784c1ea66ae4274e24e3f37118315a5eecc21806997151e77f63edc0f3785e7f3de0e67227ae5a73b9d9b4a272bb5e5783260ec5a9ba0fc6efd1"
}