A public challenge server running unpatched PHP 8.4.26 offered a small bitcoin prize to anyone who could get code execution on it. The site says it fell after 19.28 hours, at 15:47 UTC on Oct 25, with 0.02511679 BTC (about $2,021) in the pot. The winner has since published a single-file, standard-library Python proof of concept and a detailed write-up.

• Chain: at most 20 HTTP requests. An out-of-memory error during session upload-progress parsing leaves stale state in a reused worker. Follow-up requests leak a heap address and a PHP code address through oversized PHPSESSID cookies, then a final ~369 KB POST plants a fake structure so that cleanup calls PHP's system handler.
• Reliability: 7 of 10 runs succeeded in the author's lab (Alpine PHP 8.4.26 built-in server with four workers behind nginx). The offsets are tied to that exact build, so a Debian FPM build with the same version string fails at the code-leak stage. Retargeting it is work, but no longer research.
• The author notes gaps in the live run's evidence: the original requests weren't captured, and the recovered key didn't match the advertised prize address, which the author says the challenge creator acknowledged.

This matches the four-stage pattern in the PHP2Shell hunt. With working exploits in public and the CISA deadline on Oct 29, patch to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a distro backport, restart workers, and alert on unusually large Set-Cookie: PHPSESSID responses.