Comment by lossolo

I have a PoC generated by an LLM that can crash sites using php2shell, but crashing != RCE. The issue is that, to achieve actual RCE, recreating the RCE PoC based on the git diff of the patch and blog posts about php2shell isn't enough. You would still need to develop a working exploit chain, bypass ASLR, and so on to actually achieve RCE.

Also, this site runs Nginx with PHP-FPM, not Apache, which is harder than using mod_php exploit mode for this exploit.

So you would need to develop a working exploit chain and then essentially "burn" it by exposing it to the site owner.

In other words, someone is offering $500 for a working exploit chain.