LiveOverflow

I sent him an email. Quote:

> It was index.html but served from PHP's webserver.

OP confirmed that it wasn't exploitable, because it was not even running PHP code.

OP confirmed that the server was initially serving only an index.html. In that configuration, the vulnerable code path is never reached — it requires a .php file.

OP added php-version.php roughly 18–19 hours into the experiment (I'm not sure of the exact timing), so that period should be subtracted from the publicly displayed challenge duration.

Based on my external fingerprinting, I now believe the setup should actually be exploitable!

However, the server is being absolutely hammered with requests and crashes. Making it significantly harder to pull off. This is imo still an unrealistic target. If you are not taking the top 1% PHP websites, then they will have long periods (1 minute) of no traffic.

If someone manages to pull off a working exploit under these conditions, that would be crazy to me.

I believe it's not exploitable. People say that it's obviously easy when you know the exact config. So can you proof it's even possible? I am pretty outspoken about php2shell being realistic to exploit, so I am happy to independently verify to everybody that it is a realistic setup. You can reach me @LiveOverflow on Twitter or so.

From my raisistance.com blog 10 October 2026 00:05:56–25 October 2026 09:25:02 UTC:

- 95.3% of seconds had zero logged requests

- 11,582 of 22,159 complete minutes (52.3%) had no requests. The longest quiet stretch was 27 minutes 26 seconds.

- 3,283 continuous quiet stretches lasted at least 120 seconds. Together they totalled 225 hours 27 minutes 27 seconds—61.0% of the logged timespan.

- Excluding Apache’s internal dummy connections: 3,305 qualifying stretches totalled 227 hours 1 minute 51 seconds—61.5% of the timespan.

- Of 38,389 seconds with exactly one request, 14,692 contained an Apache ::1 internal dummy connection. Others included homepage visits, WordPress login requests, crawlers, and scanner probes.

thanks you, but I don't want to use that as an excuse. The AI content is really just a reflection of what excites me right now... sorry :D

And this php2shell vulnerability perfectly hits the sweet spot for me and is one of the coolest vulns I have ever seen.

I didn't say it's "end of the world". I am just saying it's an insane vulnerability.

It's not easily defeated by the default setup. Quite the contrary, the default setups are great. Typical apache + mod_php is the easiest to exploit. For example:

- Docker image `php:8.5.11-apache` is easy to exploit.

- Or the WordPress blog I installed with Digital Ocean template in 2023.

dunno. Isn't LAMP a common PHP stack?

This is easy to exploit for example: `docker docker run -d --rm -p 0.0.0.0:80:80 wordpress@sha256:c96e9e9a8ead2fea02f05469b356134da45681aaefa0f961a87653d58c462794` (basically `wordpress:7.1.3-php8.5-apache` with vulnerable php version 8.5.11)

1. I dont have an AI pentesting platform.

2. This CTF is using nginx which has a `client_max_body_size=1m` limit. My exploit right now requires more, but I will give it a try (aka ask Codex).

3. You can setup a server with `docker run php:8.5.11-apache` with any of the over 400 vulnerable `php` apache images and give me the IP.

If it's nginx + fpm + "empty" index.php, it's a meme and not exploitable.

edit: looks more like nginx + cli-server. But the 1MB nginx body limit is annoying. Why is nobody setting up these CTF servers with a setup people actually say would be easy to exploit. Like a LAMP stack.

interesting! I never thought about that somebody might interpret it in this way