A PHP2Shell exploit cracked a server baited with $2,000 in bitcoin in 19 hours

A server running an unpatched copy of PHP, left online with a bitcoin wallet key inside as bait, lasted less than a day. A researcher using the handle KillaBoi broke in through PHP2Shell, the pair of critical flaws in the language behind most of the web, and pulled the key out. The same weekend, a honeypot run by a security lead at Perplexity recorded an attacker doing the same to a real server, which ends the comfortable theory that these bugs were too awkward for anyone to use.

That matters to anyone who runs a website, and to anyone whose data sits on one. PHP sits underneath WordPress, Drupal, Joomla and most shared hosting, and these flaws can let someone with no account run commands on the server. Since the fixes arrived, the main argument for waiting has been that public attack attempts kept failing. Both results knock that argument down.

The challenge, called Steal My Bitcoin, went up on its own website and was announced in a forum post. Its creator, posting as cloudlandsdev, wrote: “Made this because I’m curious if anyone out there has figured out how to actually use this PHP RCE, we spent the last few days panicking. Have fun!” The pot started at about $502 and grew through donations to 0.02511679 BTC, worth $2,021.22 by the time it was claimed, roughly 19 hours after launch, according to Tom’s Hardware. The server buckled under the traffic from people trying, and limited storage meant it could not keep all its logs.

KillaBoi then published a proof of concept on GitHub. Mark Maunder, founder of the WordPress security company Wordfence, called the write-up “the absolute best explanation you’ll see on how hard #php2shell is to exploit,” pointing to how much precise work the attack demanded. Hard, it turns out, did not mean slow.

The more worrying result came from outside the game. Adel Karimi, detection and response lead at Perplexity, said his honeypots caught a confirmed remote code execution against an Apache server running PHP 8.4.26. “This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process,” he wrote, as BleepingComputer reported. Expel threat researcher Marcus Hutchins, who had been tracking claims of successful attacks, called it “by far the highest quality confirmation of in-the-wild php2shell exploitation I’ve seen so far.” Until then, Cloudflare, watchTowr, Patchstack and other security firms had logged only failed attempts, and Amazon‘s threat intelligence team had seen scanning begin four days before the patches shipped.

Neither result means every unpatched server falls tomorrow. The key KillaBoi recovered did not match the wallet address the site advertised; the organizer called it a setup mistake and said the funds would be transferred, according to Cointelegraph, and the security site Cyberpress notes that the public evidence shows a key being retrieved, not the prize being stolen. The published exploit is also tuned to one particular build of PHP and fails against other builds of the same version, so it is not a point-and-click tool. What is gone is the defense that nobody has made it work.

The exposure is global. Government agencies in the Netherlands, Australia, Japan and Finland took critical websites offline while the patches were prepared, Cointelegraph reported. A Shodan count by the security firm Mallory found about 884,000 internet-facing hosts advertising a PHP version that no longer gets official fixes, 59% of the roughly 1.5 million that reveal one, according to Notebookcheck. Those are banner counts, not confirmed victims, because Linux distributions often patch old packages without changing the version number.

For site owners, the fix has not changed. The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, published on October 21 for CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10. On shared hosting that update comes from the host, not from a WordPress or plugin update, so the useful question for your provider is which PHP build your site runs and when it was patched. The US cybersecurity agency CISA has told organizations that cannot update, or that still run PHP 8.1 or older, to take those systems offline until they can.

The next problem is already open. On Friday the PHP team published a workaround for a third remote code execution flaw, CVE-2026-115560, which has no patch yet and only affects systems “with an unusual combination of configuration and application code.” Until a fix ships, PHP’s developers advise switching off the session.upload_progress setting, the same step they recommended before the PHP2Shell patches. Security support for PHP 8.2 ends on December 31, 2026, and the servers that never left 8.1 are already past theirs.

Tags: Cybersecurity, bitcoin, Perplexity, PHP, PHP2Shell, WordPress