DeepSeek V4.1 Flash nearly discovers PHP2Shell RCE

An author tested whether a local DeepSeek model could independently discover the PHP2Shell remote code execution vulnerability prior to its public disclosure. Using source code, a Docker container, and a leaked demo video, the model identified the correct failure mechanism involving fatal errors and session upload progress, though it failed to produce a working exploit without human steering and PHP expertise. Open article →