Hacker Exploits Critical PHP2Shell Flaws to Win $2,000 Bitcoin Challenge, Releases PoC

A security researcher known online as killa has won a public Bitcoin challenge by using two critical PHP flaws to reach a test server. The winning run took 19.28 hours. The prize pot was 0.02511679 BTC, worth $2,021.22 at the time of the win on October 25, 2026, at 15:47 UTC. The researcher then published a proof of concept (PoC) on GitHub.

The challenge ran on stealmybitcoin.com. The site used unpatched PHP and held a wallet key behind a remote code execution test, which means the goal was to run commands on the server from the outside.

Donations pushed the prize from $500 to more than $2,000 while the test ran. The creator said early tries failed because the server first served static files through PHP’s command-line mode, which skipped the bugs. After the site moved to a real PHP page, the test became possible.

PHP2Shell Flaws Exploited

The bugs are tracked as CVE-2026-109618 and CVE-2026-109619, and the group is called PHP2Shell. Both carry a CVSS v4.0 score of 9.2, which is rated critical. The first bug can corrupt memory during cleanup after an out-of-memory condition. The second lets data left by an earlier request in a shared worker be reused by a later request.

PHP released fixes on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Google’s guidance says the affected range covers PHP 5.4 through 8.5.11. Older branches such as 8.1 and earlier no longer get official fixes, so those sites need to move to a supported version.

The public script uses two memory leaks. The first leak reveals a heap address, and the second reveals a PHP code address. With both addresses, a final request places a forged structure in memory that leads PHP to call its system function. The script then prints a random test marker, the user ID, and the hash of the flag program.

The write-up also shows the limits of the work. The script was built and tested against a local lab copy, not the live site, and it succeeded in about seven of ten lab runs. The author admits that the full live request was not captured. The recovered key also did not match the advertised prize address, and the author called that a mistake on the creator’s side.

Public exploit code is now available, and hacking activity started before the patches. Amazon reported attempts dating back to October 17, four days before the fixes. Sophos said it blocked attempts to deliver Potassium, a likely Mirai botnet variant, but it found no proof of a successful compromise.

Upgrading to a patched PHP release is the only full fix. Firewall rules and configuration changes may reduce risk, but they do not close the flaws. After upgrading, restart services and confirm that the active workers run the new build, because bundled runtimes and containers may still use old code.

For more background, read our earlier coverage of the PHP2Shell vulnerability and public PoC and the PHP emergency patch release.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Hacker Exploits Critical PHP2Shell Flaws to Win $2,000 Bitcoin Challenge, Releases PoC appeared first on Cyber Security News.