Hacker Exploits Critical PHP2Shell Flaws to Win $2,000 Bitcoin Challenge, Releases PoC - CyberSecurityNews

The challenge, hosted on stealmybitcoin.com, required participants to reach a test server holding a wallet key behind a remote code execution test. The site used unpatched PHP and initially served static files through PHP’s command-line mode, which skipped the vulnerabilities until the site moved to a real PHP page.

Donations pushed the prize from $500 to more than $2,000 during the 19.28-hour winning run. The researcher then published a proof of concept on GitHub, making the exploit publicly available.

The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS v4.0 score of 9.2, which is rated critical. The first bug can corrupt memory during cleanup after an out-of-memory condition, while the second lets data left by an earlier request in a shared worker be reused by a later request.

The public script uses two memory leaks to reveal a heap address and a PHP code address. With both addresses, a final request places a forged structure in memory that leads PHP to call its system function, allowing the script to print a random test marker, the user ID, and the hash of the flag program.

Emergency patches and exploitation attempts

PHP released fixes on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Google’s guidance says the affected range covers PHP 5.4 through 8.5.11. Older branches such as 8.1 and earlier no longer get official fixes, so those sites need to move to a supported version.

The researcher built and tested the script against a local lab copy, not the live site, and it succeeded in about seven of ten lab runs. The author admits that the full live request was not captured, and the recovered key did not match the advertised prize address, which the author called a mistake on the creator’s side.

Hacking activity started before the patches, with Amazon reporting attempts dating back to October 17, four days before the fixes. Sophos blocked attempts to deliver Potassium, a likely Mirai botnet variant, but found no proof of a successful compromise.

Recommended security measures

Upgrading to a patched PHP release is the only full fix. Firewall rules and configuration changes may reduce risk, but they do not close the flaws. After upgrading, restart services and confirm that the active workers run the new build, because bundled runtimes and containers may still use old code.

Gurubaran KS, a cybersecurity analyst and journalist, emphasizes the importance of updating defenses against new malware as soon as it appears and integrating threat intelligence feeds with data from 16,000 SOCs.