Hacker Cracks Unpatched PHP Server and Claims Bitcoin Bounty
An experiment testing claims about the real-world exploitability of critical PHP software vulnerabilities concluded when a hacker successfully breached a deliberately vulnerable web server.
Radwan AbdulhadiEditor and technology writer
The Challenge and the Bounty
A hacker has successfully breached a vulnerable server, claiming a prize pot worth $2,021.22 in Bitcoin after exploiting PHP2Shell vulnerabilities, as detailed in a report by Tom's Hardware. The challenge creator confirmed the win on October 25, ending an experiment designed to test claims that exploiting critical software vulnerabilities is becoming easier.
The challenge was hosted on the Steal My Bitcoin website and announced through a forum post, initially offering approximately $502 worth of Bitcoin. Donations subsequently increased the pot to 0.02511679 BTC, worth $2,021.22 at the time of the win. The website recorded the successful claim at 15:47 UTC on October 25, after the challenge had been running for approximately 19.28 hours.
Understanding the PHP2Shell Vulnerabilities
The experiment follows the disclosure of CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities that can allow remote code execution under certain conditions. The flaws received critical severity ratings, and fixes were released on October 21. Turning the vulnerabilities into a reliable attack, however, requires more than simply running a publicly available exploit against an arbitrary server.
The challenge's creator, posting under the name 'cloudlandsdev', stated that the project was designed to see whether anyone could use the vulnerabilities to compromise the server and claim its Bitcoin. PHP2Shell refers to two vulnerabilities in PHP's request-handling and memory-management processes. Under vulnerable configurations, an attacker could potentially exploit these flaws to execute code with the privileges of the web server account.
Execution of the Attack
The experiment quickly attracted attention, but the resulting traffic also became a problem. In an update, the creator noted that visitors were exhausting the server's available computing resources shortly after each capacity increase. Limited storage also prevented the server from retaining all its logs, complicating efforts to document a successful attempt.
The winner, known as 'KillaBoi', published a proof of concept describing the attack against the live challenge and providing a local test environment. The exploit took advantage of PHP's handling of multipart uploads and session data. By pushing a PHP worker beyond its memory limit, the attacker left internal state in an inconsistent condition, allowing subsequent requests to expose memory contents through session cookies and providing information about PHP's memory structures and executable code.
Aftermath and On-Chain Activity
The attacker used the discovered memory addresses to construct a forged PHP data structure that triggered command execution during cleanup. The final request returned evidence that the command had run inside the PHP process. Although the server was successfully compromised, the recovered private key did not match the advertised prize address. However, on-chain data shows the funds were subsequently sent to an address labeled as a Kraken cold wallet.
Security teams continue to face pressure to patch PHP installations following the public disclosure of PHP2Shell. A separate report on the vulnerability disclosure controversy detailed how premature publication disrupted the coordinated release process. Nonetheless, evidence of the latest successful attack suggests that exploiting these PHP vulnerabilities may not be as difficult as some initially anticipated.
Historical Context of Bitcoin Recovery
Past Bitcoin recovery efforts have typically involved reverse-engineering software rather than exploiting a live server. In 2024, hardware hacker Joe Grand and researcher Bruno recovered access to 43.6 BTC belonging to an owner identified as Michael, who had forgotten a 20-character wallet password by reverse-engineering an older version of RoboForm's password generator.
A more recent case involved a Bitcoin holder who recovered five BTC worth roughly $400,000 in May 2026 after losing access to the wallet for years. The pseudonymous owner stated that Anthropic's Claude AI helped identify a backup file from December 2019, which could be decrypted using a password previously written down in a notebook, containing the necessary keys to access the cryptocurrency.
Sources
- Tom's HardwareBitcoin reward offered to anyone who could break into an unpatched server running PHP, hacker cracks site and claims bounty
Continue chronologically
Related entity coverage
Related stories
CISA Confirms Active Exploitation of PHP2Shell Flaws
CISA adds critical PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog and orders federal agencies to patch systems quickly.
PHP2Shell Flaws Successfully Exploited in the Wild
Critical PHP2Shell remote code execution vulnerabilities are now successfully exploited in the wild following early disclosures and leaks.
PHP2Shell Leaked Critical Flaws Loom Over Servers
Details on critical PHP2Shell vulnerabilities have leaked online, prompting urgent warnings of potential mass exploitation and fast patch preparation.
Cloudflare Launches PHP Capture the Flag Challenge on HackerOne
Cloudflare has introduced a PHP Capture the Flag challenge integrated with its Bug Bounty program to test WAF protections against recent vulnerabilities.
