Hacker steals $2,000 worth of Bitcoin thanks to PHP vulnerability

Home » Crypto news » Bitcoin (BTC) news » Hacker steals $2,000 worth of Bitcoin thanks to PHP flaw

https://cryptoast.fr/faille-php-php2shell-hacker-2000-dollars-bitcoin-steal-my-bitcoin/

It took a hacker a little over 19 hours to win the Steal My Bitcoin challenge. An Internet user had installed a vulnerable version of PHP, a language used by a large number of websites, on a server containing a Bitcoin private key. Anyone who managed to exploit it could walk away with the reward.

The winner, known as KillaBoi, successfully completed his attack yesterday at 3:47 p.m. UTC. The prize pool then reached 0.02511679 BTC, or approximately $2,021. The organizer, identified as cloudlandsdev on the Hacker News forum, initially put up $500, before outside contributions increased the amount.

The objective of this experiment was to check if PHP2Shell, the name given to two critical PHP flaws corrected on October 21, could really allow you to take control of a server remotely. For this, the organizer voluntarily used PHP 8.4.26, a version lacking the latest fixes.

The private key recovered by KillaBoi did not match the Bitcoin address associated with the reward. The organizer had placed the key to another branch of his wallet on the server. After confirming the success of the attack using server logs, he finally transferred the bitcoins to the winner himself.

KillaBoi published the code for his attack on GitHub, along with technical explanations. The hacker first caused a server memory exhaustion, then exploited the data left by the PHP process to recover internal addresses.

📰 Bitcoin: “AI and quantum risks make me more pessimistic than before”

This information allowed him to bypass ASLR, a protection that makes memory locations unpredictable. He then constructed fake data structures to make the server execute his own commands.

According to his demonstration, around twenty HTTP requests are enough. During 10 tests carried out in its test environment, the attack worked 7 times.

KillaBoi clarifies, however, that his exploit was developed for the particular configuration of the challenge and does not necessarily work on other PHP installations. Several participants also noted that the server was initially misconfigured, preventing exploitation of the flaw for much of the challenge.

For cybersecurity researcher Hacker Fantastic, from the company Hacker House, this demonstration confirms the seriousness of the problem.

This is a major problem. There is no doubt about it anymore, apply the patch now if you haven't already.

The two vulnerabilities, referenced CVE-2026-109618 and CVE-2026-109619, have a severity score of 9.2 out of 10. The versions corrected are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Administrators are encouraged to install these updates immediately.

Machine-translated from French