A researcher using the name “killa” has leveraged two severe PHP vulnerabilities—dubbed PHP2Shell—to breach a test server and claim the prize in a Bitcoin hacking challenge. The competition ran on stealmybitcoin.com and offered 0.02511679 BTC (about $2,020) after donations boosted the purse. The winning exploit was completed at 15:47 UTC on October 25, 2026, taking roughly 19.3 hours. A proof of concept exploit was shared publicly afterward.
The Exploited Vulnerabilities: CVE-2026-109618 & CVE-2026-109619
The defects, both assigned critical severity with a CVSS v4.0 rating of 9.2, are collectively known as PHP2Shell. The first—CVE-2026-109618—permits memory corruption during garbage collection after an out-of-memory condition. The second—CVE-2026-109619—allows residual data from previous requests in a shared worker to be unlawfully reused in subsequent requests.
On October 21, 2026, patches for these flaws were issued in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. According to guidance, PHP versions from 5.4 through 8.5.11 are susceptible. Versions earlier than 8.1 are outside official support, so sites still running those should upgrade immediately.
How the Attack Unfolded
“Killa” developed an exploit using two memory leaks: one to expose a heap address, the other to retrieve a PHP code address. Armed with both, the exploit crafts a fake memory structure that causes the system function to execute, allowing remote command execution. On successful execution, it reveals a test marker, user ID, and the hash of a flag program.
The exploit was stable in lab tests—successful in about seven out of ten runs—but its execution on the actual challenge site wasn’t fully recorded. The researcher also noted the revealed key didn’t match the challenge’s advertised prize address, a mistake attributed to the challenge creator rather than the exploit itself.
Active Exploitation & Defenses
Proof-of-concept code is now publicly available, and signs of exploitation appeared before the patches were released. Amazon observed attempts beginning October 17, four days prior to the fix rollout. Meanwhile, Sophos reported blocking delivery attempts of a Mirai botnet-like payload (Potassium), though no confirmed successful breaches have surfaced.
Mitigating the threat requires upgrading to one of the fixed PHP versions listed above. Firewall or configuration tweaks may lessen exposure but won’t fully shore up vulnerable systems. After updating, admins should restart PHP services and ensure that all workers— including those in containers or bundled runtimes—are running the patched code.
This isn’t the first alert around PHP2Shell: earlier reports highlighted the foundational vulnerability and emergency patching steps.
Why it matters: These vulnerabilities pierce deep into PHP’s core, letting attackers trigger remote code execution via memory mismanagement, a rare level of access that can lead to full system takeover. With evidence that active attacks predated patch availability, operators who delay updates risk becoming the next target.
