“Steal My Bitcoin”: Pentester pockets $2,000 in BTC using PHP2Shell

Coin Encyclopedia Improve your knowledge of cryptos

A safe with the door open, on purpose. On Saturday October 24, security researcher James Pavur put online a server deliberately vulnerable to PHP2Shell flaws with a bitcoin wallet inside and a three-word instruction: steal my bitcoin. Nineteen hours later, a 26-year-old pentester based in the United Kingdom left with the keys.

The community increased the bounty from $500 to $2,000 in one weekend and the winner donates part of it to an association of lupus patients. The process dear to Schneier took three hours of actual work here.

Exclusive JDC offer: until October 30, 2026, open your Finst account and receive €50 in Bitcoin! Create a Finst account in 5 minutes Commercial link

The principle of a classic bug bounty involves a platform, a form and a committee which judges the seriousness before paying. Pavur deleted all that. A server, a known flaw, a bitcoin address: the first to execute code on the machine serves itself. The payment is the proof, and the blockchain serves as the record.

The mechanics appealed. According to The Register, the initial stake of $500 was quadrupled by the community, reaching $2,000, or approximately 0.025 bitcoin, during this Wednesday, October 28, around $80,500.

The winner is Jaydip Modhwadia, a UK-based developer and pentester known as Killa. The site's counter displays "My Bitcoin was stolen after 7:28 p.m.", but the person concerned puts things into perspective: he worked "around three hours in total". Pavur had added a PHP entry point that the exploit needed around 1 p.m. UTC on October 25, and remote code execution fell to 3:47 p.m. UTC.

Its payload fits into a single Python file and “twenty HTTP requests maximum”. The script mainly bypasses ASLR, the protection which randomly mixes the memory addresses of a program to make life difficult for attackers. The code is public on GitHub.

Modhwadia announced that he would donate part of the profit to the Lupus Foundation, which fights lupus, an autoimmune disease from which he himself suffers. In 2021, the Poly Network hacker put his bounty of $500,000 back into play after returning $610 million, for whoever would do better than him.

The two flaws, CVE-2026-109618 and CVE-2026-109619, affect all versions of PHP since 5.4, in other words the engine of a large part of the global web. According to Brian Krebs, Censys identified 2.58 million exposed hosts and 54.9 million web properties running PHP at the time of the October 21 emergency patches.

Machine-translated from French