Hacker Demonstrates PHP Remote Code Execution in StealMyBitcoin Challenge, Shares Exploit

A security researcher has successfully demonstrated a PHP remote code execution (RCE) exploit against theSteal My Bitcoin challenge.

This proof-of-concept (PoC) exploit illustrates how specially crafted HTTP requests can trigger memory corruption, disclose internal PHP addresses, and execute commands on a vulnerable server.

The researcher, using the GitHub username KillaBoi, published the exploit in a public GitHub repository and detailed an attack against PHP version 8.4.26.

This demonstration follows the disclosure of two critical PHP vulnerabilities,CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Both vulnerabilities carry a CVSS v4.0 score of 9.2 and may allow unauthenticated remote code execution under vulnerable conditions.

The exploit specifically targets PHP’s session upload-progress handling and memory management. According to the researcher’s documentation, a specially crafted multipart/form-data request forces PHP to allocate significantly more memory than the request’s actual size.

The attack employs deeply nested form-field names to exhaust PHP’s configured memory limit of 128 MiB, potentially leaving stale session-related data inside a reusable worker process. Subsequent requests exploit this state to disclose memory addresses through PHPSESSID cookies.

The attack proceeds through four stages:

The two address disclosures help bypass Address Space Layout Randomization (ASLR), which independently randomizes the locations of PHP’s executable code and heap memory.

The researcher constructs a forged PHP HashTable containing a manipulated destructor callback. During cleanup, PHP interprets this corrupted structure and invokes zif_system, the internal handler associated with PHP’s system() function.

Example output from the researcher’s local test includes:

[health] PHP 8.4.26 confirmed
[heap] strict Zend base 0x78113e800000
[code] strict zval_ptr_dtor 0x615b1f512930
{"stage":"final","execution_proof_verified":true}

The published PoC requires Python 3.11 or newer and does not need any third-party dependencies. It generates HTTP requests, validates memory leaks, and records evidence from each execution stage.

The researcher reportedsuccessfully executing the exploit against the live challenge on October 25, 2026, at 15:47:38 UTC. The final HTTP POST returned a PHP memory-exhaustion error followed by a Wallet Import Format (WIF) private key.

However, the researcher noted that the recovered key did not correspond to the Bitcoin address advertised on the challenge website, a discrepancy the challenge creator acknowledged.

In a controlled Docker environment, the researcher reproduced the command execution and successfully retrieved output from a test binary.

Testing showed successful execution in seven of ten attempts, with failures primarily due to worker-selection races and memory-layout differences.

The PoC is specifically calibrated for Alpine PHP 8.4.26 with four CLI-server workers, and its hardcoded offsets may not apply to other PHP builds.

This demonstration underscores how PHP memory-management flaws can escalate from resource exhaustion to information disclosure and ultimately remote command execution.

Organizations should update vulnerable installations to PHP 8.4.27, 8.3.36, 8.2.35, or 8.5.12, depending on their supported branch.

Administrators should monitor for unusual multipart requests, repeated PHP memory-exhaustion errors, abnormal session cookies, and unexpected commands executed by PHP worker processes.

Although the published exploit is tailored to a specific challenge environment, it further demonstrates the potential ramifications of the recently disclosed PHP2Shell vulnerabilities.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.

A security researcher has successfully demonstrated a PHP remote code execution (RCE) exploit against theSteal My Bitcoin challenge.

This proof-of-concept (PoC) exploit illustrates how specially crafted HTTP requests can trigger memory corruption, disclose internal PHP addresses, and execute commands on a vulnerable server.

The researcher, using the GitHub username KillaBoi, published the exploit in a public GitHub repository and detailed an attack against PHP version 8.4.26.

This demonstration follows the disclosure of two critical PHP vulnerabilities,CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Both vulnerabilities carry a CVSS v4.0 score of 9.2 and may allow unauthenticated remote code execution under vulnerable conditions.

The exploit specifically targets PHP’s session upload-progress handling and memory management. According to the researcher’s documentation, a specially crafted multipart/form-data request forces PHP to allocate significantly more memory than the request’s actual size.

The attack employs deeply nested form-field names to exhaust PHP’s configured memory limit of 128 MiB, potentially leaving stale session-related data inside a reusable worker process. Subsequent requests exploit this state to disclose memory addresses through PHPSESSID cookies.

The attack proceeds through four stages:

The two address disclosures help bypass Address Space Layout Randomization (ASLR), which independently randomizes the locations of PHP’s executable code and heap memory.

The researcher constructs a forged PHP HashTable containing a manipulated destructor callback. During cleanup, PHP interprets this corrupted structure and invokes zif_system, the internal handler associated with PHP’s system() function.

Example output from the researcher’s local test includes:

[health] PHP 8.4.26 confirmed
[heap] strict Zend base 0x78113e800000
[code] strict zval_ptr_dtor 0x615b1f512930
{"stage":"final","execution_proof_verified":true}

The published PoC requires Python 3.11 or newer and does not need any third-party dependencies. It generates HTTP requests, validates memory leaks, and records evidence from each execution stage.

The researcher reportedsuccessfully executing the exploit against the live challenge on October 25, 2026, at 15:47:38 UTC. The final HTTP POST returned a PHP memory-exhaustion error followed by a Wallet Import Format (WIF) private key.

However, the researcher noted that the recovered key did not correspond to the Bitcoin address advertised on the challenge website, a discrepancy the challenge creator acknowledged.

In a controlled Docker environment, the researcher reproduced the command execution and successfully retrieved output from a test binary.

Testing showed successful execution in seven of ten attempts, with failures primarily due to worker-selection races and memory-layout differences.

The PoC is specifically calibrated for Alpine PHP 8.4.26 with four CLI-server workers, and its hardcoded offsets may not apply to other PHP builds.

This demonstration underscores how PHP memory-management flaws can escalate from resource exhaustion to information disclosure and ultimately remote command execution.

Organizations should update vulnerable installations to PHP 8.4.27, 8.3.36, 8.2.35, or 8.5.12, depending on their supported branch.

Administrators should monitor for unusual multipart requests, repeated PHP memory-exhaustion errors, abnormal session cookies, and unexpected commands executed by PHP worker processes.

Although the published exploit is tailored to a specific challenge environment, it further demonstrates the potential ramifications of the recently disclosed PHP2Shell vulnerabilities.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.