---
title: Someone beat the "Steal My Bitcoin" PHP2Shell challenge in 19 hours, and the winner's complete exploit is now public on GitHub with about a 70% success rate in its lab | ctxsec
url: https://ctxsec.com/items/php2shell-steal-my-bitcoin-won-public-end-to-end-poc
description: ""
status: "primary sources (challenge site and winner's public repo); public exploit code; lab-calibrated to one PHP build"
published: 2026-10-27
---

> 

[← Cybersecurity News](/news) · [markdown](/items/php2shell-steal-my-bitcoin-won-public-end-to-end-poc.md)

primary sources (challenge site and winner's public repo); public exploit code; lab-calibrated to one PHP build

2026-10-27

### Someone beat the "Steal My Bitcoin" PHP2Shell challenge in 19 hours, and the winner's complete exploit is now public on GitHub with about a 70% success rate in its lab

A public challenge server running unpatched **PHP 8.4.26** offered a small bitcoin prize to anyone who could get code execution on it. The site says it fell after **19.28 hours**, at 15:47 UTC on **Oct 25**, with 0.02511679 BTC (about $2,021) in the pot. The winner has since published a single-file, standard-library Python proof of concept and a detailed write-up.

- **Chain:** at most 20 HTTP requests. An out-of-memory error during session upload-progress parsing leaves stale state in a reused worker. Follow-up requests leak a heap address and a PHP code address through oversized `PHPSESSID` cookies, then a final ~369 KB POST plants a fake structure so that cleanup calls PHP's `system` handler.
- **Reliability:** 7 of 10 runs succeeded in the author's lab (Alpine PHP 8.4.26 built-in server with four workers behind nginx). The offsets are tied to that exact build, so a Debian FPM build with the same version string fails at the code-leak stage. Retargeting it is work, but no longer research.
- The author notes gaps in the live run's evidence: the original requests weren't captured, and the recovered key didn't match the advertised prize address, which the author says the challenge creator acknowledged.

This matches the four-stage pattern in the [PHP2Shell hunt](/items/hunt-php2shell-successful-chain-four-stage-fingerprint). With working exploits in public and the CISA deadline on Oct 29, patch to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a distro backport, restart workers, and alert on unusually large `Set-Cookie: PHPSESSID` responses.

Sources: [Steal My Bitcoin: challenge won (Oct 25, 15:47 UTC)](https://stealmybitcoin.com/) · [KillaBoi: StealMyBitcoin-PoC, winner's write-up and single-file PoC (GitHub, Oct 25-26)](https://github.com/KillaBoi/StealMyBitcoin-PoC) · [CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (Oct 26)](https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog)