upvote
Hey, good to hear that it was just YouTube holding the comment. I really thought you deleted it which was audacious. I'm now much less mad :P.

I think we can set up something interesting here, I'd be down to set up a little "PHP2Shell Olympics" as we change preconditions and see how well the exploits fare. I am pretty sure our opinions of "this can be exploited, and LLMs can aid a rapid exploit of previously-complex ASLR nonsense" and "it's difficult to do memory corruption over the internet; php2shell is not a log4shell moment" are mutually compatible.

My contact details are on the bottom of the blog post.

reply
Really, your request log is empty for hours at a time? I find that hard to believe. Even old blog sites still get an insane amount of bot traffic. I have sites that are only barely in googles index and it’s pretty rare to see anything less than 1 req/s (99% bot traffic)
reply
Yes! Even my own stuff sometimes goes a few hours to a day without a single request, the internet is either very slow and dead or super active, no in-between, I think it heavily depends on who indexed you and how big your site looks like or maybe identified stack (for vuln crawlers, i'd wager if they see a wordpress marker they'd put you on some list to get retried by the swarm) or something.

My datamining project for a game for example, that noone besides me and 2 friends use, gets thousands of requests per second, because all the AI bots found it and try to index every single page (thousands of ssr pages) and they repeat the requests when my cache-control headers expire (ie: when i consider the old page stale), so it's an endless stream (I dont mind the challenge of serving all of these at high performance xD).

My main website, in the same domain (not a subdomain), barely gets any requests, it only has the one main index page with a single link to the datamining subdomain, that's about it.

reply
From my raisistance.com blog 10 October 2026 00:05:56–25 October 2026 09:25:02 UTC:

- 95.3% of seconds had zero logged requests

- 11,582 of 22,159 complete minutes (52.3%) had no requests. The longest quiet stretch was 27 minutes 26 seconds.

- 3,283 continuous quiet stretches lasted at least 120 seconds. Together they totalled 225 hours 27 minutes 27 seconds—61.0% of the logged timespan.

- Excluding Apache’s internal dummy connections: 3,305 qualifying stretches totalled 227 hours 1 minute 51 seconds—61.5% of the timespan.

- Of 38,389 seconds with exactly one request, 14,692 contained an Apache ::1 internal dummy connection. Others included homepage visits, WordPress login requests, crawlers, and scanner probes.

reply