Bitcoin Challenge Tests Whether PHP Flaws Can Expose a Hidden Key

A public security challenge is testing whether users can use two recently patched PHP flaws to retrieve a hidden key from a server running an older version of the software. The test centers on PHP2Shell, a pair of vulnerabilities that can allow remote code execution under certain conditions. Steal My Bitcoin gives the PHP user access to a print-flag binary that reveals the key. Its maker, posting as cloudlandsdev, said the challenge was created to see whether anyone could use the newly disclosed flaws in practice. “I'm curious if anyone out there has figured out how to actually use this PHP RCE we spent the last few days panicking over,” cloudlandsdev wrote. An initial page snapshot displayed a reward of 0.00625104 BTC.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to TokenPost.