What is PHP2Shell and how does it work?

On October 20th, someone posted the details of two critical PHP bugs on Hacker News, two days before a scheduled fix. The bugs, called PHP2Shell, don’t need an account on your site, a vulnerable plugin, or a bug in your own code, just a form request like a file upload. About 69% of sites with a known server-side language run PHP, so I made a video on what happened, how the bugs actually work, and whether they’re as big a deal as the headlines made them sound.

It ends on four questions worth asking in a retro.