Hacker Claims Over $2,000 in Bitcoin by Exploiting PHP Vulnerabilities

A hacker successfully breached a server with PHP2Shell vulnerabilities, winning a Bitcoin prize totaling $2,021.22. This incident, reported on the Steal My Bitcoin website, not only highlights the potential severity of such vulnerabilities but also culminates in a unique challenge designed to test their exploitability.

Details of the Challenge

Launched on October 24, the challenge started with an initial reward of roughly $502 in Bitcoin. As participants began to engage, donations increased the prize pot to 0.02511679 BTC, amounting to over $2,000 at the time of the win. The challenge concluded on October 25, when the creator confirmed the successful exploit at 15:47 UTC, after approximately 19.28 hours of continuous operation.

CVE Vulnerabilities in Focus

The experiment was initiated following the discovery of two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619. These flaws allow for remote code execution under certain conditions and have been classified with a critical severity rating. Although patches for these vulnerabilities were released on October 21, effectively exploiting them requires advanced knowledge, rather than merely applying publicly available exploits.

Insights from the Challenge Creator

The challenge’s architect, known by the alias ‘cloudlandsdev’, expressed a curiosity regarding the community’s ability to exploit these PHP vulnerabilities effectively. Posting on an online forum, they stated, “Made this because I’m curious if anyone out there has figured out how to actually use this PHP RCE, we spent the last few days panicking. Have fun!”

Technical Aspects of the Exploit

The PHP2Shell exploits vulnerability centers around PHP’s request-handling and memory-management functions. Under certain vulnerable settings, an attack can enable the execution of code using the web server’s privileges. The winning participant, identified as ‘KillaBoi’, shared a proof of concept on GitHub, detailing their methodology in breaching the server.

• The attack leveraged multipart uploads and improperly handled session data.
• By exceeding the memory limit of a PHP worker, internal state inconsistencies were introduced.
• Subsequent requests revealed memory content, providing insights into memory structures and executable code locations.

Recovery Efforts and Digital Trends

Despite the successful breach, it’s noteworthy that the private key retrieved by the hacker did not align with the advertised reward address. Evidence indicates that the stolen funds were transferred to a Kraken cold wallet, labeled under the address “bc1qr4…lk7a9”. This incident highlights the challenges associated with recovering Bitcoin, a process that often requires reverse-engineering software rather than exploiting live systems.

Future Implications

As security teams face mounting pressure to rectify vulnerabilities in PHP installations, recent events shed light on the ease of exploiting such flaws. The swift execution of the challenge attracted considerable attention, though the influx of traffic soon began to overwhelm the server’s resources. Challenges in storage also hindered comprehensive logging of attempts, complicating verification processes.

In conclusion, this incident exemplifies both the vulnerabilities present in widely used software and the community’s capability to engage with these security challenges. It serves as a reminder of the ongoing need for robust cybersecurity measures as technology continues to evolve.