None of you are entitled to an exploit which allows you to touch any target you want. I release code because it's fun. You blue team motherfuckers crying for now three days because exploits drop fail to see the point, without people dropping exploits, you have no job. There is no defensive without offense. Stop fucking crying, and do the job you're paid to do. I do not give a fuck about your weekend and I quite enjoy your crying. Also; just so you're aware, I've been up front. I never claimed this thing touched nginx. The fucking demo used lab env (look at the demo) + LAN addresses, FPM on 9xxx What part of that do you not understand? A proof of concept is just that: something that proves a concept. Most people submitting a bug for review would stop at a crash dump. If you read the readme, before I nuked the github, you'd know. proof an exploit in lab conditions is possible, and exploiting it in the wild are two different things. I read everything that comes out. Github is full of PoC's on this issue. Multiple reports PHP (patched) is still vulnerable. having fpm behind your httpd isn't a patch. There's still a double free in the code base, still a UAF that has a block to actual exploitation. Multiple serialization bugs. Swoole is also an issue. You people can eat a dick. Show me on the doll where the PHP2SHELL CVE's show up in our code? is php2shell php2shell2shell? If you want a villain who's also an asshole you've got him now. Dragging my fucking name, threatening my Life, my family, and now, telling me and people I follow you wanna wear our skin like a suit and rape our mothers while you make us watch? Now trying to reach out and touch me? Thanks 2FA. ;) Speaking of, if anyone shows up here, my 2FA becomes my 2A. I didn't spend 550 on a Glock to get into a fist fight. I've been a pretty nice guy until today. You're gonna see a side of me, none of you are going to like. You're gonna need to call LE and your boss, you fuckers are in for a long weekend.