Get past the PHP2shell panic and prove what's exploitable
Wednesday, November 18, 2026
10am PT | 1pm ET
On October 21, PHP shipped emergency fixes for two flaws that let an attacker with no login run code on a web server. Probing had started before most teams had even read the advisory. Since then, the internet has filled up with scanners, plugins, hot takes and retractions.
Patching is step one. The harder question is one a version number can’t answer: could anyone actually get in?
Join Sarah Hyatt, Product Manager at XBOW, and Federico Kirschbaum, Head of Security Lab at XBOW, for a clear-eyed look at PHP2shell: what happened, what’s signal and what’s noise, and what it takes to move from “possibly vulnerable” to proof. Form a deeper understanding of:
What PHP2shell is, how it unfolded, and why the old race between attackers and defenders ran on a much shorter clock this time
What the public needs to know and who is actually at risk
Where PHP hides, why a vulnerable version isn’t the same as an exposed system, and why outside scans can miss systems that are there
Checking for PHP2shell safely inside an assessment and what evidence of exposure looks like
Speakers
Head of Security Lab @ XBOW
Product Manager @ XBOW
