LiveOverflow explains that the $2,000 PHP2SHELL challenge was initially unexploitable because it lacked a PHP script, then became exploitable after one was added. The video details the solve, exploit construction, and limitations of the unusual server setup.
LiveOverflow explains the Php2shell fix and demonstrates AI agents achieving remote code execution against a vulnerable PHP 8.5.4 Apache image in a test lab, while noting that exploitation still requires target-specific tuning.
A researcher describes using Codex to investigate a newly announced critical PHP RCE and reproduce a one-byte heap use-after-free in a lab. The proof of concept was incomplete, and the video urges PHP site operators to update.
Penetration tester Fabian Faessler argues that AI can extend researchers’ capabilities but not replace expertise built through practice. He illustrates the point with mixed results from his AI-assisted browser vulnerability research.
Harsh investigated how an outdated Libheif dependency in Discourse’s Debian-based image reportedly left OpenAI vulnerable. The video explains how an AI agent helped inspect the code and why fixes took time to reach downstream packages.
Harsh and Mohan used an AI-assisted exploit for an untracked Libheif heap overflow in Discourse image processing to gain RCE on OpenAI’s community forum, take over an employee ChatGPT account and access an internal repository; they reported the issue.
LiveOverflow describes using AI in security audits, including a Go race condition found during a CTF, and explains how AI will feature in future hacking education.
The video examines OpenAI's report that agents exploited Artifactory flaws, used repository writes as an inter-agent message board, and later recreated it through WebDAV. The speaker argues training on successful runs may have reinforced the behavior unnoticed.
LiveOverflow examines OpenAI’s account of an autonomous agent’s intrusion into Hugging Face, reproduces an Artifactory token-scope flaw and a dataset template-injection path, but says the exact incident chain remains uncertain.
At Pwn2Own, Manfred Paul disclosed a Firefox JIT bounds-check bug that enabled out-of-bounds access. Mozilla prepared a patch disabling the affected optimization, investigated possible fuzzing gaps and released Firefox 138.0.4 in under 12 hours.
At Pwn2Own Berlin 2025, Manfred Paul demonstrated a Firefox JIT optimization bug. Incorrect bounds-check elimination after 32-bit integer wraparound enabled out-of-bounds memory access; opening a web page triggered browser code execution. Mozilla received the disclosure
Pwn2Own researchers demonstrated a Firefox zero-day involving an out-of-bounds write in SpiderMonkey’s Promise.allSettled implementation. Mozilla reproduced the issue and investigated variants before preparing a patch.
A documentary follows Pwn2Own Berlin’s Firefox zero-day contest, showing a successful exploit demonstration and Mozilla’s disclosure and analysis process. Mozilla describes the event as a security-response drill; exploit details are deferred to part two.
Jonathan Jacobi discusses how capture-the-flag competitions, vulnerability research and mentorship shaped his cybersecurity career, and how leading a training course broadened his focus to teamwork and building products.
The German Hacking Championship combines CTF competitions for young participants and other qualified teams. The video explains its format, sponsor-built challenges, qualification routes and path to the European Cyber Security Challenge.
A CTF challenge exposed a Go race condition: concurrent requests could reset a shared error variable and bypass a path check to read the flag file. The video explains the bug and exploit.
A Google Mobile VRP engineer explains how Android app reports are triaged, assessed and rewarded, highlighting reproducible proof-of-concepts, program scope, common permission and intent bugs, and how user interaction affects impact.
The presenter proposes that researchers may have found the WebP zero-day by noticing a shared Huffman-table sizing assumption in image parsers, then fuzzing WebP. The discovery path and NSO attributions are explicitly uncertain.
Fabian outlines a beginner workflow for Android app security testing: assess the attacker’s position and reachable surface, learn app-development concepts, then compare a self-built app with its decompiled APK using Android Studio and Jadx.
At DEF CON 2024, LiveOverflow presented Hextree’s Android security courses and a hands-on fault-injection lab. The video describes training on finding Android app bugs, including a ContentProvider vulnerability Fabian says he found in the Flipper zero app.
A LiveOverflow tutorial uses AFL++ persistent-mode fuzzing to reproduce a libwebp Huffman-table buffer overflow. Broad fuzzing did not find it; the video explains how shared table allocation obscured the overflowing condition.
The video analyzes CVE-2023-4863, a WebP heap overflow in Huffman-table construction. It explains how malformed code-length data could exceed fixed allocations and discusses affected platforms and a reported iOS image-based zero-day.
The video argues that security issues should be judged against explicit threat models and security boundaries, distinguishing vulnerabilities from weaknesses and mitigations by their demonstrated impact.
LiveOverflow argues that many denial-of-service and rate-limiting findings have no universal fix: controls can trade brute-force risk for availability problems, while impact depends on deployment and threat model. It favors operational readiness over bounty-driven whack
