A public challenge built to show that PHP2Shell was over-hyped has been solved. stealmybitcoin.com left about $2,000 in Bitcoin behind an unpatched PHP server, and on October 25, 2026 a researcher using the handle killa finished a winning run after 19.28 hours, then published a proof of concept on GitHub. The server was running PHP 8.4.26, one release before the fix.
The result cuts both ways. It confirms the bugs are exploitable in practice, and it also confirms how much work that takes. Either way, the advice is unchanged: move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart.
Quick reference
| Question | Answer |
|---|---|
| What was it? | A live challenge with about $2,000 in Bitcoin on an unpatched PHP 8.4.26 server |
| Who solved it? | A researcher known as killa, finishing October 25, 2026 at 15:47 UTC |
| How long? | 19.28 hours for the winning run |
| Was the exploit public? | Yes, a PoC is on GitHub |
| Was the prize paid? | Unconfirmed. The recovered key did not match the advertised wallet |
| Does it prove PHP2Shell is easy? | No, but it proves it works |
| What should I do? | Patch, restart, confirm workers run the new build |
What the challenge was meant to show
The setup went viral on October 25 when security researcher hacker.house posted that someone had "loaded [a vulnerable PHP website] with a Bitcoin wallet" and challenged the internet to take it, with a running timer "to show if the PHP exploitability was over-hyped." The same account added that the owner was "clearly trying to show something, that the media … have overstated the risk," while calling the vulnerability genuine and telling people to patch.
It was a fair question. Our earlier coverage of PHP2Shell and the AI-era attack window argued exploit speed was the story, and a skeptic can reasonably ask whether a working attack exists beyond a crash.
What happened
The server did not fall immediately. Cyber Security News reports early attempts failed because the site served static files through PHP's command-line server mode, which bypassed the bugs. Bitcoin.com made the same observation while the timer was still running. A real PHP endpoint was added, and the attempts started working.
According to the CVE-2026-109618 and CVE-2026-109619 write-ups, one bug is memory corruption after an out-of-memory condition and the other lets stale state leak between requests in a worker. A technical write-up of killa's PoC by lilting.ch describes the chain at a high level:
- An oversized upload hits the 128 MiB memory limit during upload progress tracking, leaving a worker in a corrupted state that later requests reuse.
- Responses carry residual memory in session cookies, which the script parses to recover a heap address.
- The same technique recovers a code address, defeating ASLR.
- A final request plants crafted data so PHP's cleanup routine calls into command execution, and the output returns over the HTTP connection.
Mark Maunder of Wordfence called the result "the absolute best explanation you'll see on how hard #php2shell is to exploit."
What is verified, and what is not
| Claim | Status | Notes |
|---|---|---|
| The challenge was solved on October 25, 2026 | Reported by several outlets | Organizer James Pavur publicly congratulated killa |
| Winning run took 19.28 hours | Reported | Figure from Cyber Security News |
| The PoC is public | Verified by link | GitHub repository KillaBoi/StealMyBitcoin-PoC; we did not run it |
| The PoC was built on a local lab copy | Reported by its author | About 7 successes in 10 lab runs, no retry loop |
| The live run was fully captured | No | The author says raw live requests were not recorded |
| The recovered key matched the advertised wallet | Disputed | Cointelegraph and the PoC author both report a mismatch |
| The funds were transferred | Unconfirmed | Organizer said they would be, as of our sources |
| This proves the bugs are easy | Not supported | The chain needs leaks, an ASLR bypass and memory layout knowledge |
We read the write-ups and did not visit the challenge site or run the proof of concept. Treat the timings as the reporters' figures, not ours.
Why the key mismatch matters
If the recovered key did not unlock the advertised wallet, then the exploit chain worked but the prize was not, strictly, taken as designed. The organizer called it a mistake in the initial wallet configuration. For defenders this is a footnote. The point of the challenge was code execution, and by every account the final request ran a command on the server.
What this changes for you
- Exploitability is now demonstrated. "Theoretical" no longer fits for unpatched PHP exposed to uploads. A public PoC lowers the cost for the next person, even if it needs calibrating per build.
- Your build may differ, but not safely. The write-up says the offsets were tuned to an Alpine build and failed fingerprint checks on a Debian image. That slows copy-paste attackers. It does not protect you.
- Patched is the only full fix. PHP fixed this in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Our patch guide for Ubuntu, Debian, RHEL and Docker has the commands, and the end-of-life note covers 8.1 and 7.4, which get no official fix.
- Restart and verify. Bundled runtimes and containers can keep running old code after a package update.
- Interim hardening, with care. One write-up says
session.upload_progress.enabled=0stops this particular PoC at the first leak and that keeping upload limits under 128 MiB prevents the needed worker state. That describes one chain, not every possible chain.
Where Beam fits
Beam does not run on your web server and cannot patch PHP. If a coding agent on your machine writes Dockerfiles or provisioning scripts, Beam can record those commands and flag risky ones, which helps catch an agent pinning an old php:8.4.26 image. It does not detect PHP2Shell exploitation. For that, patch and review your server logs for oversized upload requests.
What we are watching
- Whether the organizer confirms the Bitcoin transfer.
- Whether the PoC is adapted to Debian, FPM or Apache builds.
- First reports of PHP2Shell exploitation in the wild beyond challenge servers.
Related reading
- PHP2Shell and AI agents: why the attack window just collapsed
- PHP2Shell: how the OOM and stale-state bugs work
- PHP2Shell patch guide for Ubuntu, Debian, RHEL and Docker
- PHP end of life: PHP2Shell and the versions with no fix
- What to do after an attack on your app: incident response playbook
- October 2026 attacks timeline
Sources: Cyber Security News · Cointelegraph Hodler's Digest · lilting.ch PoC write-up · Bitcoin.com · KillaBoi/StealMyBitcoin-PoC
Details are accurate as of October 26, 2026 and rest on secondary reporting; payout status and exploit reliability may change.