Hacker Exploits Two PHP Flaws to Steal $2,000 in Bitcoin

A hacker stole more than $2,000 worth of Bitcoin (BTC) by exploiting two critical vulnerabilities in the PHP language, as part of an online challenge designed to test the robustness of web servers. The attack, carried out in under 19 hours, highlights the persistent risks related to the security of infrastructure hosting crypto-asset wallets, while the Bitcoin market remains stable around a $600 billion market capitalization. Context The incident comes at a time when software flaws continue to pose a major threat to online services managing digital assets. PHP, a programming language used by nearly 75% of websites according to W3Techs estimates, was updated on October 21, 2026 to fix two critical vulnerabilities, dubbed PHP2Shell. These flaws, rated 9.2 out of 10 on the CVSS severity scale, allow remote code execution (RCE) and unauthorized access to server files. The "Steal My Bitcoin" challenge, launched by an internet user under the pseudonym cloudlandsdev on the Hacker News forum, aimed to assess the real danger of these vulnerabilities. The organizer had deliberately installed an unpatched version of PHP (8.4.26) on a server hosting a Bitcoin private key, offering an initial reward of $500, later raised to more than $2,000 thanks to external contributions. This type of initiative, although controversial, is common in the cybersecurity community to test the limits of existing protections. At the time of the attack, Bitcoin was trading around $80,269, with a market capitalization of $1.61 trillion, according to CryptoScore Pro data as of October 26, 2026. Despite the stability of prices, the incident occurs in an environment marked by heightened vigilance from regulators and investors regarding hacking risks, particularly following the entry into force of the European MiCA regulation in 2024. The facts The attack was carried out by a hacker known by the alias KillaBoi , who managed to seize 0.02511679 BTC (about 2,021 dollars at the rate of the day) on October 25, 2026 at 3:47 p.m. UTC. According to information published by Cryptoast, the theft was carried out by exploiting the PHP2Shell vulnerabilities (referenced CVE-2026-109618 and CVE-2026-109619), enabling remote takeover of the target server. Here are the key elements of the operation: The total time to compromise the server was 19 hours, from the discovery of the vulnerability to the transaction moving the funds out. The targeted server hosted a Bitcoin wallet accessible through a web interface, whose private key was stored in plain text or in an insecure configuration file. The average Bitcoin network fee rate at the time of the incident was 0.135 sat/vB, making the transaction cost for transferring the funds negligible, according to Cryptoast's data. Contrary to what was initially announced, the private key recovered by KillaBoi did not correspond to the Bitcoin address associated with the reward. The challenge organizer had in fact placed on the server the key of another branch of his wallet, before transferring the funds to the hacker himself after validating the attack. KillaBoi published the code of his exploit on GitHub, detailing a two-step method: A first phase of exhausting the server's memory, followed by exploiting the residual data to identify internal addresses. Bypassing ASLR ( Address Space Layout Randomization ), a protection designed to make memory locations unpredictable, through the construction of fake data structures. According to his tests, the attack worked in 7 out of 10 cases in a controlled environment, but KillaBoi specifies that his exploit was specific to the configuration of the challenge and does not guarantee its effectiveness on other PHP installations. Several participants also pointed out that the server had been misconfigured for much of the challenge, delaying the exploitation of the flaw. Beyond this isolated case, broader concerns have emerged. The cybersecurity company CYFIRMA has identified a reconnaissance campaign targeting 216 potentially vulnerable servers affected by PHP2Shell, particularly in the government, banking and industrial sectors, according to a report cited by The Hacker News . The operations, carried out from 21 compromised machines, are reportedly attributed to North Korean hackers linked to the Lazarus group, although this attribution remains uncertain. Furthermore, Palo Alto Networks reported an attack against a European administration, without being able to confirm the use of PHP2Shell flaws. Understanding Key Concepts Remote Code Execution (RCE) Remote Code Execution (RCE) is a vulnerability that allows an attacker to execute arbitrary commands on a remote server or system, without having physical access to it. In this case, the PHP2Shell flaws allowed KillaBoi to inject malicious code via HTTP requests, thereby taking control of the server. For example, an attacker could exploit an RCE to access sensitive files, such as private keys of crypto wallets, or to install malware. Private Key and Transaction Signing A private key is a secret string of characters that proves ownership of a Bitcoin address and authorizes transactions. In this incident, the hacker retrieved the private key stored on the server to sign a transaction transferring funds to their own wallet. The digital signature, generated from this key, is what validates the transaction on the blockchain. If a private key is compromised, the associated funds become accessible to anyone who holds it, which is why it is essential to store it securely (for example, in a hardware wallet or a digital vault). ASLR ( Address Space Layout Randomization ) ASLR is an information security technique that randomizes the location of data in memory, thereby complicating attacks that exploit software vulnerabilities. In the case of PHP2Shell, KillaBoi bypassed this protection by exploiting residual data left by the PHP process to rebuild malicious data structures. This type of bypass illustrates the ongoing race between…