[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-hacker-wins-2021-bitcoin-bounty-with-php2shell-exploit":10,"sections":45},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":34,"tags":35,"sources":40,"feedback":44,"feedback_at":22,"cost_usd":44,"total_tokens":44},12386,"hacker-wins-2021-bitcoin-bounty-with-php2shell-exploit","Hacker Wins $2,021 Bitcoin Bounty With PHP2Shell Exploit","A deliberately vulnerable PHP server fell in about 19 hours, a small data point on how fast critical flaws turn into working attacks.","A hacker using the name KillaBoi broke into a deliberately vulnerable PHP server on October 25 and claimed a Bitcoin prize worth $2,021.22, four days after fixes for the underlying flaws shipped.\n\nThe challenge ran on the Steal My Bitcoin website, set up by a creator posting as cloudlandsdev. It opened at about $502, and donations lifted the pot to 0.02511679 BTC. The site logged the winning claim at 15:47 UTC, roughly 19.28 hours in. The target ran PHP with two critical flaws, CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell. Under vulnerable configurations, they can allow remote code execution, meaning an attacker runs commands on a machine they do not own, with the web server account's privileges.\n\nKillaBoi published a proof of concept on GitHub, with a local test environment. The attack pushed a PHP worker past its memory limit through multipart uploads and session data, leaving internal state inconsistent. Later requests leaked memory addresses through session cookies, and those addresses let the attacker forge a data structure that triggered a command during cleanup. The final request returned evidence the command had run.\n\nThe run was messy. Visitors exhausted the server's computing resources after each capacity increase, and limited storage meant the logs were incomplete. The recovered private key did not match the advertised prize address, though on-chain data shows the funds went to an address labeled as a Kraken cold wallet.\n\nThe creator built the challenge to test whether anyone could actually use the bug, writing that \"we spent the last few days panicking.\" One server, one skilled winner and 19 hours is evidence, not a survey. The target was known, advertised and paying a reward, which real-world attacks rarely get. Still, a public exploit with a test environment lowers the bar for the next person.\n\nPrior Bitcoin recoveries were offline puzzles. In 2024, Joe Grand and a researcher named Bruno reverse-engineered an old RoboForm password generator to recover 43.6 BTC. In May 2026, a holder known as cprkrn recovered five BTC after Claude helped locate a 2019 backup file. This one hit a live server under traffic, and turning the flaws into a reliable attack takes a chain of steps, not a single pasted exploit. How many production configurations match that chain is the open question.","[\"php\",\"vulnerability\",\"bitcoin\",\"exploit\"]","2026-10-26T10:30:00.000Z","2026-10-26T11:32:18.410Z","2026-10-26T11:32:20.594Z","published",null,[24,30],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Remove the line 'Nothing in the material explains the mismatch,' which acknowledges missing source material inside the article; state the key-versus-address mismatch and the Kraken-labeled transfer as fact without that editorial aside, and avoid implying the creator has or hasn't explained it.","resolved",{"id":31,"reviewer":26,"round":32,"reason":33,"status":29},"editor-r2",2,"The 'Nothing in the material explains the mismatch' aside is gone, but the closing paragraph still says 'The source says a public exploit run blindly against arbitrary servers is not enough,' which cites an unnamed source as meta-text; attribute it to Tom's Hardware by name or state it plainly, and drop or support the 'attackers who knew exactly where to look' claim.","security",[36,37,38,39],"php","vulnerability","bitcoin","exploit",[41],{"name":42,"url":43},"Tom's Hardware","https:\u002F\u002Fwww.tomshardware.com\u002Ftech-industry\u002Fcryptomining\u002Fhacker-offers-bitcoin-reward-to-anyone-who-can-break-into-an-unpatched-server-running-php-still-remains-unhacked-php2shell-challenge-tests-claims-that-ai-makes-exploiting-vulnerabilities-easy",0,{"sections":46},[47,52,56,61,66,71,76,81,86,91,96,101,106,111],{"name":48,"slug":49,"count":50,"latest_published_at":51},"AI","ai",7083,"2026-10-25T15:25:40.000Z",{"name":53,"slug":34,"count":54,"latest_published_at":55},"Security",1069,"2026-10-26T12:00:52.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Policy","policy",589,"2026-10-26T11:05:02.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Deals","deals",575,"2026-10-26T10:23:06.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Consumer Tech","consumer-tech",303,"2026-10-26T11:31:21.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Hardware","hardware",297,"2026-10-26T11:24:42.000Z",{"name":77,"slug":78,"count":79,"latest_published_at":80},"Science","science",218,"2026-10-23T22:48:25.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Startups","startups",148,"2026-10-23T16:26:29.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"Software","software",145,"2026-10-26T09:30:00.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":95},"Dev Tools","dev-tools",122,"2026-10-21T16:00:00.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"General","general",104,"2026-10-26T09:26:49.000Z",{"name":102,"slug":103,"count":104,"latest_published_at":105},"Gaming","gaming",88,"2026-10-22T22:25:33.000Z",{"name":107,"slug":108,"count":109,"latest_published_at":110},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":112,"slug":113,"count":114,"latest_published_at":115},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]