Public PoC exploits PHP2Shell for RCE on PHP 8.4.26
Original title: Hacker Demonstrates PHP Remote Code Execution in StealMyBitcoin Challenge, Shares Exploit
The PoC is tuned for Alpine PHP 8.4.26 and succeeded in seven of ten lab runs.
Researcher KillaBoi published a proof-of-concept that triggers remote code execution on PHP 8.4.26 through session upload-progress memory handling, tied to CVE-2026-109618 and CVE-2026-109619 (PHP2Shell, CVSS 9.2). Crafted multipart requests leak heap and code addresses to bypass ASLR, then call PHP’s system() handler. The exploit ran against the Steal My Bitcoin challenge on October 25, 2026. Users are advised to update to PHP 8.4.27, 8.3.36, 8.2.35, or 8.5.12.
Unconfirmed: The recovered challenge key did not match the advertised address, and offsets may fail on other PHP builds.
- Both CVEs are scored CVSS v4.0 9.2 and may allow unauthenticated RCE.
- Hardcoded offsets target Alpine PHP 8.4.26 with four CLI-server workers.
- The challenge returned a WIF key that did not match the advertised Bitcoin address.
- The PoC needs Python 3.11 or newer and no third-party dependencies.
Impact: Unauthenticated remote command execution on the PHP worker
| Product | Affected | Fixed in |
|---|---|---|
| PHP | 8.4.26 demonstrated; supported branches before the stated fixes | 8.4.27, 8.3.36, 8.2.35, or 8.5.12 |
- 1.Update supported PHP branches to 8.4.27, 8.3.36, 8.2.35, or 8.5.12.
- 2.Watch for unusual multipart requests, PHP memory-exhaustion errors, and abnormal session cookies.
- Vendors
- PHP
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
From the original article
2 min read at gbhackers.com
A security researcher has successfully demonstrated a PHP remote code execution (RCE) exploit against the Steal My Bitcoin challenge. This proof-of-concept (PoC) exploit illustrates how specially crafted HTTP requests can trigger memory corruption, disclose internal PHP addresses, and execute commands on a vulnerable server. The researcher, using the GitHub username KillaBoi, published the exploit in […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.