Critical PHP2Shell flaws exploited for $2,000 bounty, PoC released

Key Takeaways

• A cybersecurity researcher successfully exploited two critical PHP vulnerabilities, collectively known as PHP2Shell, to win a Bitcoin bounty challenge.
• The flaws, CVE-2026-109618 and CVE-2026-109619, both carry a critical CVSS v4.0 score of 9.2.
• PHP has released patches for these vulnerabilities in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, on October 21, 2026.
• Proof-of-concept (PoC) exploit code has been publicly released, and exploitation attempts were detected prior to the official patch availability.

A security researcher operating under the handle “killa” has claimed a significant Bitcoin bounty after successfully demonstrating the exploitation of two critical vulnerabilities within the PHP scripting language. The researcher navigated a public challenge, which involved executing remote code on a test server, completing the task in just under 20 hours. The bounty, initially valued at $500, grew to over $2,000 (0.02511679 BTC) through donations by the time it was awarded on October 25, 2026, at 15:47 UTC. Following the successful exploit, killa made the Public exploit code is now available on GitHub.

The “StealMyBitcoin” challenge was hosted on stealmybitcoin.com. Its objective was to gain remote code execution on a server running unpatched PHP to retrieve a wallet key. Initial attempts by various participants were unsuccessful because the server first served static files via PHP’s command-line interface, which circumvented the vulnerabilities. The challenge became viable only after the site transitioned to serving content through a standard PHP web page.

PHP2Shell Flaws Exploited

The vulnerabilities exploited are identified as CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell. Both flaws are rated critical, each assigned a CVSS v4.0 score of 9.2. CVE-2026-109618 involves memory corruption that can occur during the cleanup process after an out-of-memory condition. The second vulnerability, CVE-2026-109619, facilitates the reuse of data from a previous request by a subsequent one within a shared worker process.

Patch Availability and Affected Versions

PHP addressed these critical vulnerabilities with fixes released on October 21, 2026. The patched versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Google’s analysis indicates that PHP versions ranging from 5.4 up to 8.5.11 are affected. Older branches, specifically 8.1 and earlier, no longer receive official security updates, necessitating an upgrade to a currently supported version for those installations.

Exploitation Mechanism

The public exploit script leverages two distinct memory leaks. The first leak discloses a heap address, while the second reveals a PHP code address. With both critical addresses obtained, a specially crafted final request can place a forged structure into memory. This manipulation tricks PHP into invoking its system function, allowing the attacker to execute arbitrary commands. The script then prints a random test marker, the user ID, and the hash of the flag program to confirm successful exploitation.

The researcher’s documentation also highlighted certain limitations. The exploit was developed and primarily tested against a local laboratory environment, not the live challenge site, achieving success in approximately 70% of lab runs. The author acknowledged that the full live request sequence was not captured. Furthermore, the recovered key did not align with the advertised prize address, which the author attributed to an error on the challenge creator’s part.

Pre-Patch Exploitation Attempts

Exploitation attempts related to these vulnerabilities were observed even before the official patches were released. Amazon reported detecting attempts as early as October 17, four days prior to the patch availability. Sophos also indicated blocking efforts to deliver Potassium, a suspected variant of the Mirai botnet, though no evidence of successful compromise was found.

What You Should Do

• Upgrade PHP Immediately: The most comprehensive solution is to upgrade all PHP installations to the patched versions (8.5.12, 8.4.27, 8.3.36, 8.2.35, or newer).
• Restart Services: After upgrading, ensure all relevant services are restarted and confirm that active PHP workers are running the newly installed build, especially in environments utilizing bundled runtimes or containers.
• Review Legacy Systems: If running PHP 8.1 or older versions, immediate migration to a supported and patched version is critical, as these branches no longer receive security updates.
• Implement Defense-in-Depth: While not a complete fix, consider implementing additional firewall rules and configuration changes to reduce exposure and risk, complementing the necessary PHP upgrade.
• Monitor for Exploitation Attempts: Keep an eye on logs and security alerts for any signs of exploitation attempts, even after patching.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.