A cybersecurity expert, known by the alias ‘killa’, successfully claimed the prize in a public Bitcoin challenge by exploiting two significant PHP vulnerabilities. The challenge, which took place on the platform stealmybitcoin.com, was completed in just over 19 hours, resulting in a reward of 0.02511679 BTC, equivalent to $2,021.22 at the time of victory on October 25, 2026. Following the win, the researcher shared a proof of concept (PoC) on GitHub, providing insight into the exploit.
The Bitcoin Challenge
Hosted on stealmybitcoin.com, the challenge involved breaching a test server protected by unpatched PHP, with the goal of executing remote commands to retrieve a wallet key. Initially set at $500, the prize pool grew to over $2,000 through donations. Early attempts were thwarted as the server initially served static files that bypassed the vulnerabilities. However, once the server transitioned to dynamic PHP pages, the challenge became solvable.
Details of the PHP2Shell Vulnerabilities
The exploited vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are collectively referred to as PHP2Shell. Both vulnerabilities have a critical CVSS v4.0 score of 9.2. The first flaw involves memory corruption during cleanup after an out-of-memory condition, while the second allows data reuse across requests in a shared worker environment. PHP addressed these issues with updates released on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Sites still operating on older PHP versions are urged to upgrade to mitigate risks.
Impact and Recommendations
The PoC leverages two memory leaks to uncover critical addresses, enabling a final request to manipulate memory and execute system functions. Although the exploit was tested extensively in a lab environment, it faced some limitations; the full live request wasn’t captured, and the recovered key differed from the advertised one due to an oversight by the challenge organizers. Public use of the exploit has been reported, with attempts noted prior to the patches’ release. Security companies, including Amazon and Sophos, have detected and blocked related malicious activities, though no successful breaches have been confirmed.
To fully resolve these vulnerabilities, it is crucial to upgrade to the newly patched PHP versions. While firewall configurations can mitigate some risk, they do not completely eliminate the flaws. After upgrading, it is important to restart services and validate that systems are running the updated software.
Stay informed about emerging security threats and integrate threat intelligence feeds to bolster defenses against potential exploits. For further reading, refer to our previous articles on the PHP2Shell vulnerabilities and the PHP emergency patch release.
