CONNECT WITH US
Tech

Tech

Bitcoin reward offered to anyone who could break into an unpatched server running PHP, hacker cracks site and claims bounty

Tom's Hardware logo

Published on

Add as a preferred source on Google
Bitcoin reward offered to anyone who could break into an unpatched server running PHP, hacker cracks site and claims bounty

A hacker has successfully breached a vulnerable server, claiming a prize pot worth $2,021.22 in Bitcoin after exploiting PHP2Shell vulnerabilities, a posting on the Steal My Bitcoin website has shown. The challenge's creator confirmed the win on October 25, ending an experiment designed to test claims that exploiting critical software vulnerabilities is becoming easier.

The challenge, hosted on the website a day earlier and announced through a forum post, initially offered approximately $502 worth of Bitcoin. Donations subsequently increased the pot to 0.02511679 BTC, worth $2,021.22 at the time of the win. The creator's website recorded the successful claim at 15:47 UTC on October 25, after the challenge had been running for approximately 19.28 hours.

The experiment follows the disclosure of CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities that can allow remote code execution under certain conditions. The flaws received critical severity ratings, and fixes were released on October 21. Turning the vulnerabilities into a reliable attack, however, requires more than simply running a publicly available exploit against an arbitrary server.

The challenge's creator, posting under the name ‘cloudlandsdev’, had said the project was designed to see whether anyone could use the vulnerabilities to compromise the server and claim its Bitcoin. “Made this because I'm curious if anyone out there has figured out how to actually use this PHP RCE, we spent the last few days panicking. Have fun!” the creator wrote.

PHP2Shell refers to two vulnerabilities in PHP’s request-handling and memory-management processes. Under vulnerable configurations, an attacker could potentially exploit these flaws to execute code with the privileges of the web server account.


Source link
Related Topics:Tech

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.