PHP2Shell and Bitcoin: a key was recovered in 19 hours. What really happened?

Bitcoin on the server and an open invitation: what was the challenge?

“Steal My Bitcoin” sounds like a major cryptocurrency theft: an unpatched PHP server held a Bitcoin key, and somebody got it. The essential detail is that the server was set up specifically for a public, authorised security challenge. Its organiser invited participants to demonstrate remote code execution using the vulnerabilities nicknamed PHP2Shell.

The contest started after the PHP security fixes released on 21 October 2026. The two relevant flaws are CVE-2026-109618 and CVE-2026-109619. According to the organiser’s published challenge source, the target ran PHP 8.4.26, before the fixed 8.4.27 release. This was a deliberately vulnerable lab, not a company store or customer server found at random.

The 19-hour headline has an important twist

The public challenge result and the winner’s account report command execution and recovery of a Bitcoin-formatted private key at 15:47 UTC on 25 October 2026. The challenge had been running for 19.28 hours. That figure describes this event; it does not predict how long an attacker would need against any production PHP site.

Researchers questioned whether the initial web route reached a vulnerable PHP process at all. The organiser later made a PHP endpoint available so the intended path could be tested. The total challenge duration and the time during which the target was actually reachable through that route are therefore different. A headline that gives only “19 hours” hides a material part of the story.

The recovered key did not open the prize wallet

The winner’s account says the retrieved value had a valid Bitcoin private-key format, but it did not derive the advertised funded address. The organiser acknowledged this as a configuration mistake. The challenge was accepted on the evidence of command execution and retrieval of the server-side secret; the organiser then transferred the bounty separately.

The 0.02511679 BTC was the advertised challenge prize, not a measured customer loss. Contemporary coverage valued it at about $2,000, but exchange prices change, so the BTC amount is the more durable number. What matters technically is that a secret accessible through the compromised process was recovered.

What does the result prove about PHP2Shell?

The winner published a technical account that discusses both its evidence and its gaps. It makes a strong case for code execution inside the PHP process on that particular build and configuration. It does not prove that every WordPress, WooCommerce or Laravel deployment can be compromised in the same way or within the same time. Runtime version, web-server routing, configuration and worker behaviour matter.

Sophos reported exploitation attempts and one successful exploitation in its 22 October update, while saying that, at that time, its analysts had not seen evidence tying the observed activity to ransomware, data theft or supply-chain compromise. That is the limit of one vendor’s telemetry at one point in time, not a claim about every later incident. The authorised contest should be distinguished from attacks seen against production systems.

Why should a website or shop owner care?

The business risk extends well beyond cryptocurrency. Code execution with the PHP web worker’s permissions may expose files, database credentials and application secrets that worker can access. Depending on the system, consequences can include data exposure, service interruption, malicious changes and further access. Only logs and incident investigation can establish what happened to any particular site.

On shared hosting, ask the provider to confirm the PHP build actually serving your site and its security fix. On a VPS, inventory every PHP process, container image and panel component; install the fixed release and restart affected services. Updating a WordPress plugin does not replace the underlying PHP runtime.

• Identify the PHP version handling web requests; command-line `php -v` can report a different build.
• Install the official fixed release or a documented vendor backport, then replace running worker processes.
• Review relevant web, PHP and system logs, plus unexpected file or process changes.
• If there are signs of compromise, preserve evidence and start a separate incident response.

How we checked this story

This article reflects information available on 29 October 2026. We cross-checked event claims against the winner’s published account and the organiser’s released challenge source. We used the PHP project for the patch facts and Sophos for the scope of observed attack activity. We did not independently analyse the blockchain transfer, so the description of the prize payment follows the published event accounts.

If a verified additional incident or correction appears, this article can be updated with a new date. The aim is to keep three things separate: code execution demonstrated in the lab, the organiser’s prize payment, and claims about real customer losses that the cited sources do not establish.