That's interesting because there were people complaining yesterday that this was a fully static website with no PHP involved lol
replyhttps://news.ycombinator.com/item?id=50234254
reply OP confirmed that the server was initially serving only an index.html. In that configuration, the vulnerable code path is never reached — it requires a .php file.
OP added php-version.php roughly 18–19 hours into the experiment (I'm not sure of the exact timing), so that period should be subtracted from the publicly displayed challenge duration.HITCON CTF has a realistic php2shell challenge. Think it has ended up with 0 solves so far, not sure.
replyThe "realistic setup" used for this didn't have a php page on it initially.
replyI'm skeptical of the value of such setups, unless it's clear it's an out of the box setup, and we already know those are totally broken.
I don't understand who these people think they are really fooling. Is this some AI denial?
There are many PoCs online that work on realistic setups (like PHP docker image). If you're curious you can try to replicate it locally.
replyare you saying this lead to dos (and less competition)? or easier penetration?
replyAt first glance, this wouldn't affect demonstration of the vuln.