AI;DR
AI;DR
← Back to live feed1 story

Monday, Oct 26, 2026

1

Researcher Cracks Viral StealMyBitcoin Server in Hours, Proving AI-Found PHP2Shell Bug Is Exploitable

marketbrief.nowResearch1d

Security researcher killa breached the unpatched PHP server behind the stealmybitcoin.com challenge within hours of its configuration being fixed, demonstrating that the AI-discovered PHP2Shell vulnerability is exploitable. The breach occurred after LiveOverflow identified that the server was initially routing requests through a static HTML file without initializing PHP, and the operator later exposed an actual PHP endpoint. The server's creator had configured the machine with the wrong Bitcoin wallet address, leaving the advertised $2,000 bounty untouched even after the server was compromised.

Sign in to suggest

Key sources

  1. SOURCE@hackerfantastic“Someone has created a vulnerable PHP website, loaded it with a Bitcoin wallet, and challenged the Internet to hack into it and they can keep the Bitcoin. It has a running timer to show if the PHP exploitability was over-hyped.”x.com
  2. SOURCE@liveoverflow“stealmybitcoin was just solved by @killa. Or rather solved a few hours ago. He was confused because the wallet address was wrong. Turns out the server didn't have the right wallet”x.com
  3. SUPPORT@intcyberdigest“A developer hid a Bitcoin key on a PHP server left unpatched against PHP2Shell, the critical flaws fixed on Oct 21, and dared anyone to steal it. 17 hours on, the wallet holds ~$2,000 and nobody has taken it.”x.com
  4. SUPPORT@notdeghost“crazy how even w/ such a bad challenge setup (initial deployment wasn't exploitable, tons of concurrent traffic, and surprise: the wallet was setup incorrectly), this was solved in a few hours”x.com
  5. SUPPORT@s1r1u5_“for the first ~10 hours, they seemed to be serving something like index.html through a wildly uncommon setup: nginx -> proxy_pass -> php -S -> index.html if you look at the PHP CLI server code, without a router, it doesn't even initialize php for static files, so you can't trigger the vulnerable multipart parser in the first place.”x.com
  6. SUPPORT@dantemmartin“Someone just hid a $500 bitcoin key on a server running PHP from before the PHP2Shell patches — the RCE an OpenAI model found last week — and dared the internet to take it.”x.com
  7. SOURCEhuggingnewshuggingnews.com
Markdown