Server with Vulnerable PHP Hacked in 19 Hours

Developer cloudlandsdev organized a public challenge by placing a Bitcoin wallet on a server with vulnerable PHP. The goal was to allow anyone to hack the system and claim the reward.

The initiative was launched in response to critical PHP2Shell vulnerabilities that had already caused outages for dozens of government services in the UK. The author admitted feeling overwhelmed by the real-world exploitation of remote code execution flaws.

The initial prize was around $500, but thanks to donations, it grew to 0.025 BTC (approximately $2,000). This challenge became a kind of proving ground to test the resilience of a popular web engine.

Hacker KillaBoi completed the task in just 19 hours and published a working exploit on GitHub.

The attack relied on overloading the PHP process beyond its memory limit: uploading files and session data disrupted the system's internal state.

Subsequent requests allowed extracting memory fragments along with structure and code addresses via session cookies.

Using the gathered data, a fake structure was constructed; executing its cleanup routine triggered arbitrary command execution.

Although the captured key did not match the prize address, the author confirmed victory, and the funds were transferred to Kraken exchange's cold wallet.

Official patches were released on October 21. The speed of the hack proves that claims about the difficulty of exploiting these vulnerabilities no longer hold true.