Researcher cracks an unpatched PHP server and takes its $2,000 Bitcoin prize in 19 hours

A security researcher was able to exploit an intentionally unpatched PHP server and claim its Bitcoin bounty in just over 19 hours. The public stunt was a test to see if the recent PHP2Shell flaws are as dangerous as they are said to be. Stealmybitcoin.com logged the win at 15:47 UTC on October 25 Stealmybitcoin.com, the site where the game was hosted, verified the bounty had been claimed. Its results page shows the Bitcoin was taken after 19.28 hours, with the win being logged at 15:47 UTC on Sunday, October 25. The prize pot was 0.02511679 BTC, worth $2,021.22 at that time. The page reads: “For now, there are no bitcoin on this server,” adding that more challenges may follow.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Cryptopolitan.