PHP2Shell: How We Turned Around Aikido's Same-Day Video in 6 Hours
At 2 p.m., the footage landed. By 8 p.m., Aikido Security had a finished video and a thumbnail, ready to publish. How we turned a PHP2Shell explainer around in six hours.
Filip Grebowski4 min read
IN THIS ARTICLE
At 2 p.m., the footage landed in our inbox. By 8 p.m., Aikido Security had a finished video and a thumbnail, ready to publish.
The message from their team was short. PHP2Shell was everywhere, they had a video that needed to go live that day, and the materials would arrive at 2. Could we turn it around in time?
We could. Here’s how it went, and why more tech companies should plan for moments like this.
Not the one who handles video? Forward this to whoever runs content or DevRel at your company.
What is PHP2Shell?
PHP2Shell is the name for two critical remote code execution flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619. They live in PHP’s runtime, in how it handles requests that run out of memory, so a site can be exposed even when its own code is fine. Both score 9.2 on CVSS v4.0, and affected versions go back as far as PHP 5.4.
The disclosure didn’t go to plan. Details leaked before the official release, the PHP team pushed patches out a day early on October 21, and Cloudflare saw attack traffic before the fix was even public.
If you run PHP and came here looking for the fix: update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Aikido’s PHP2Shell guide covers affected versions and what to do if you can’t patch today.
Why it had to go out the same day
In security, the window for a story like this is measured in hours. The moment a vulnerability gets a name, developers start searching for it, and they click on whoever explains it clearly first.
A video that lands three days later answers a question everyone has already answered. For a security company like Aikido, being early with a clear, accurate explainer is how you earn trust when it counts.
So the job wasn’t just to make a good video. It was to make a good video today.
How the six hours went
We had the materials at 2 p.m. and sent back the full video at 8 p.m., thumbnail included. Six hours, start to finish.
To be honest, a six-hour edit isn’t the same as a two-week production, and it isn’t meant to be. When the clock is that short, you decide early what can’t slip: the technical explanation has to be correct, the story has to be easy to follow, and the thumbnail has to earn the click. Everything else gets done as well as the time allows.
That balance is the hard part. Going fast is easy if you’re willing to ship something sloppy. Going fast while keeping a standard a security company will put its name on takes a team that has done this many times before.
Why we can move that fast
Our team is made up of ex-engineers. When the footage covers memory exhaustion or remote code execution, nobody stops to ask what that means. We know which parts matter, so we cut with confidence instead of guessing.
We also know Aikido well. We produce their podcast, The Secure Disclosure, and their channel has grown from 500 to over 100K subscribers since we started working together. Knowing a client’s tone and style means no back-and-forth on the basics when there’s no time for it.
And tech content is what we do every day, for companies like Google, Stripe, Deepgram and The Linux Foundation. A tight deadline doesn’t change the work. It just compresses it.
Got something that needs to go out today?
Tech news doesn’t wait for production schedules. A CVE drops, a competitor ships, or your conference recap needs to be out while people are still talking about it.
If your team has footage and a deadline, send it our way. We handle tutorials, demos, founder content, ads, podcasts and short-form, as one-off projects or monthly partnerships.
Book a call on our contact page, or email us at hello@mensoi.com.
Written by Filip GrebowskiFounder of Mensoi. He runs a YouTube channel with over 100,000 subscribers and has filmed more than 100 tech videos to camera.
