Researcher exploits PHP2Shell flaws, wins Bitcoin challenge and releases PoC
Original title: Hacker Exploits Critical PHP2Shell Flaws to Win $2,000 Bitcoin Challenge, Releases PoC
CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2, were fixed October 21; Amazon saw attempts from October 17.
Researcher killa used two critical PHP bugs, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), to reach a test server on stealmybitcoin.com and claim a Bitcoin prize, then published a GitHub proof of concept. PHP shipped fixes on October 21, 2026. Amazon reported exploit attempts from October 17, and Sophos blocked attempts to deliver Potassium, a likely Mirai variant, without confirming a compromise.
Unconfirmed: The full live request was not captured, the recovered key mismatched the prize address, and Sophos found no confirmed Potassium compromise.
- The prize was 0.02511679 BTC, about $2,021.22, won on October 25.
- Google says affected versions run from PHP 5.4 through 8.5.11.
- Branches 8.1 and earlier receive no official fixes.
- The script succeeded in about seven of ten local lab runs.
- The recovered key did not match the advertised prize address.
Impact: remote code execution by calling PHP's system function
| Product | Affected | Fixed in |
|---|---|---|
| PHP | 5.4 through 8.5.11 | 8.5.12, 8.4.27, 8.3.36 and 8.2.35 |
- 1.Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
- 2.Restart services and confirm active workers run the new build.
- 3.Move unsupported 8.1 and earlier installs to a supported release.
- Vendors
- PHP
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
From the original article
2 min read at cybersecuritynews.com
A security researcher known online as killa has won a public Bitcoin challenge by using two critical PHP flaws to reach a test server. The winning run took 19. 28 hours.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.