Fixing PHP2Shell

This talk reflects on the PHP2Shell vulnerability, telling the full story of what happened and discussing its impact and why it gained so much attention.

We will cover the whole process, from what led to its discovery to testing and validation to remediation and how the PHP team coordinated and rolled out the fix.

Discussion will include how agentic security research combined with human expertise led researchers to the exploit and how LLMs are changing the landscape of security going forward.

We will reflect on lessons learned, share advice for other projects and the wider PHP ecosystem, and provide practical suggestions for organizations and projects.