Hacker Breaches Server Through 2 Critical PHP Vulnerabilities, Earns About 3,440 Manats

The hacker exploited critical PHP vulnerabilities known as “PHP2Shell” to breach an unpatched server and claim a Bitcoin reward worth $2,021.22 (about 3,440 manats). “KillaBoi” won the challenge on the “Steal My Bitcoin” website. The result was recorded at 19:47 on October 25. By then, the challenge had lasted 19.28 hours.

The project had launched one day earlier with a reward of about $502 (about 850 manats). After donations, the amount reached 0.02511679 BTC. The project was created by a developer known as “cloudlandsdev.” He wanted to test how easy it was to take control of a real server using critical PHP vulnerabilities.

“PHP2Shell” is the collective name for 2 PHP vulnerabilities involving request and memory management. They are security flaws designated “CVE-2026-109618” and “CVE-2026-109619.” Under certain server configurations, the vulnerabilities can be exploited to remotely execute malicious code. Patches for both issues were released on October 21.

“KillaBoi” published a working example of the attack and a test environment set up on a computer on GitHub. The attack exploited chunked file uploads and a flaw in session data processing. After the PHP process exceeded the memory limit, subsequent requests exposed memory addresses through session cookies. Session cookies are small pieces of data stored to identify users on a website. Using the addresses obtained, the hacker created a forged PHP data structure and executed a command on the server.

After the challenge attracted attention, visitors repeatedly exhausted the server’s computing resources. Because memory was limited, it was also impossible to retain all the logs. Although the server was compromised, the private key that was found did not match the announced reward address. Nevertheless, blockchain records show that the funds were later sent to the address “bc1qr4…lk7a9.” This address belongs to Kraken’s cold wallet, which is kept offline. The incident demonstrated that vulnerabilities in unpatched PHP systems can be exploited in real-world attacks.