Will give it some thought. I have some initial reservations about staking any claim on what happens to the money / don't want to solicit donations. From my perspective, the goal was to leave $500 on a street corner with a sign saying "Take Me!" and see how long it lasts. If someone puts their own money on the same street corner that's on them. But if the pot ever got really big and I couldn't maintain the site for whatever reason, some sort of plan is probably worth having.

Because only a fraction of people would double check (AI or otherwise), AI making it easier to flood the zone with fine tuned spam actuallu has the opposite effect. We're seeing this at play at a large scale anywhere an election is happening right now. The narratives are even less truthful than before.

Can you ask your favorite „AI” to comment on what you’ve just said?

Wow we have lost it. You really need AI to come up with something like this… let’s just end it at this point honestly.

[flagged]

So you are therefore arguing for the author's point.

The entire exercise is to counter the claim that AI means every script kiddie with tokens can just have their AI create an exploit, and then have their AI scour the internet for vulnerable endpoints. If that were true, then the exploit has very little value, because everyone could make one.

In addition, the claim is that these exploits will all immediately have a thousand bots using them to exploit every possible website, and you can't leave your website vulnerable for a second or it will immediately be owned.

The fact that that hasn't happened to this server already proves the point. Whether professionals can create an exploit from the vulnerability was never the question.

My favourite actively unreleased 0 day exploits are the ones that are released, 5 days old, and allegedly so trivial to exploit it costs $5 in tokens.

No, I will not spend $5 in tokens to claim your $1000 bounty. My $5 exploit is worth more than $1000. Thank you very much.

I suppose it may not be there for actually taking it, but it does serve as a good demonstration of the realistic risk for average people running relatively low-value PHP sites. If nobody thinks it's worth the risk of exposure for a quick and easy $1k in Bitcoin (at the time I'm writing this), why would anybody bother hacking a site that's basically worthless, like the dinky little Wordpress blog I run?

This does effectively make the statement that, there probably are exploits out there for this, but even with a non-updated version, you're not at much risk unless someone with serious resources thinks they can make pretty big money from compromising your thing.

You would have a point if it was still a 0 day. The patch is out, and open source. Anyone who cares has a bunch of the pieces for putting together their own exploit.

Zero days are valuable and kept in the bank to avoid detection. That ship has sailed.

I never mentioned unreleased private exploits, I mentioned what every thought leader and popular creative wants us to believe right now.

The whole point was someone could throws some cents and hack the site.

It’s not a 0day it’s now 5 days and counting since disclosure. Nobody is gaining value sitting on an exploit for a vulnerability which is being actively patched.

This logic doesn't work here, because it relies on the premise that you alone potentially have an unreleased zero-day exploit, which is not the case.

If prompting an AI could exploit this for less than $500 in token spend, then you should immediately do so, since if you don't, in a few minutes' time someone else will.

> The value proposition isn't there.

That's part of the point. $500 or $1000 is a trivial amount. Since the money is still there, there's currently no trivial exploit.

> requires actively utilizing an unreleased 0 day exploit on a server that will certainly be able to track exactly what was done

Depending on the exploit, and the visibility stack on the server, one may or may not be able to determine how the rabbit got in the hat.

exactly. the pros are not going to reveal their hand for $1k

Wallet address is there, you can donate

If someone was able to gain access to the server and there was no key, they would report it here with proof. If someone had a working PHP exploit and it didn't work on this server, they would be able to post it here with proof.

This is evidence of absence, though. Unexploited PHP servers are evidence of absence of exploits, and exploited PHP servers are evidence of presence of exploits. “Absence of evidence” would be if there were no PHP servers.

Maybe link to the argument? I can only find two comments from you on that post and only one person replied. That one reply isn’t from a “thought leader” either.

That's way funnier than taking it honestly

0.02500416 BTC

≈ $2,018.29 USD

Now

from flagged wallet? That'd be even funnier.

Yep! Modern Coliseum. We just need a live feed.

imagine having so much $ lying around that you do that

i picked the wrong profession

I'm seeing a few comments that say $500 isn't enough, and its not worth it for them to try to hack it. But if it costs fewer than $500 of tokens in an AI, then it seems like it is? I thought a lot of the claim people are making is that you dont actually need to hack anything you just ask an AI and it does it. The exploitable bug is public and documented. All the pieces are theoretically there, and there are repeated claims that AI is trivializing exploits and its super easy to hack things now.

If that were true, and someone can hack the server for less than $500 of tokens, its an easy profit.

$500 is the value of the prize. We don't know what the price someone will pay for a lottery ticket is.

Author is a genius troll.

I would hope it is logged. would be a pretty shitty plan if you don't read the traffic logs

Unfortunately I left all my easy PHP exploits together with my pre-2023 writing that Pangram flags as 100% AI in Canada with my long-distance girlfriend.

I have discoverd a truly marvelous RCE which this margin is too narrow to contain.

It's done, anyone still talking about this is in the business of monetizing trending keywords (or crime), not in the business of cyberdefense.

Anyone that's thinking about defending basically stopped thinking professionally about this on Thursday midday when the PHP update was released and the patch was applied. Maybe on Friday we learned that there were no confirmed exploits or even theoretical exploits, so we discarded the marginal possibility of our servers being exploited stealthily and having a dormant attacker in our perimeter (it was a buffer overflow attack after all, very hard to execute).

So it's out of mind for us, it's almost saturday, the only reason to think about this anymore is to grift or to think about the social contagion angle. To many of us it was a random tuesday, business as usual, but some people are still thinking this was a somehow special event? My guess is that it was the fact that there was an embargo break and it caused some issues in that 12 hour period between the leak and the patch, but it was a nothingburger, now it just needs to die, at least after it makes its round through the content-creators whose 9 to 5 is looking at trend charts and monetizing views.

The only reason Php2shell wasn't as bad as it could've been was because basically no malicious actors had exploits that were useful in time.

Whoever broke the embargo is a moron and it could have resulted in much more damage than was done.

Yep. I pointed an agent at the Twitter post about the "working exploit that gets a shell on an unmodified MediaWiki installation.". 5 minutes later it spins up a stock MediaWiki and proves its POC. It modified someone else's POC from Github, but that's still trivial.

They can be running a vulnerable version of PHP but also recording all traffic in a way that does not allow for wiping evidence afterwards. For example, if the PHP server was behind another server routing the raw IP packets and running tcpdump. Since the author of the site controls the TLS cert private key, TLS does not protect again the author eavesdropping.

The exploit gives you access to a machine, not necessarily the one terminating TLS and keeping logs.

After the fact you are going to clean an append-only log on a separate box?

really?

1. there's no actual evidence that the key to the wallet is on this machine at all. it would be trivial to add a service that would sign challenges to prove so

2. a working RCE against PHP is worth much more than $1000, attacking this machine would easily burn that

You mean the sever is setup with nginx defaults?

This is the CEO of ToB. It makes total sense why he'd not want to share his proof of concept.

Inert files are unrealistic, normally you use PHP server to execute PHP code, which this website doesn't appear to do (only static files). And suppose you want to accept >1mb file uploads, that limit would get in your way. So it's not a good representation of a PHP application, but for other uses it's reasonable.

How is the progress?

[flagged]

It's back online!

It's not about cracking it. I'm just following the agents' reasoning as they work through the exploit to better understand the recently discovered PHP bugs. A great way to spend a few bucks, in my opinion :D

> The only problem is that (as of now) exploiting PHP requires some knowledge about the server configuration, and we don't have that here.

Exactly. This server is exploitable, but not with an off-the-shelf PHP2Shell PoC someone found on GitHub. The PHP2Shell exploit would need adjustment to the specific application configuration, and to that end, you’ve come to the same conclusion I was implying.

The easiest way is to use PHP2Shell _with_ another unknown vulnerability in the stack, such as nginx etc…

The challenge is trivial to those who know better than to even try. You cannot succeed at it without giving away far more than you could ever possibly hope to gain.

Of course, there’s always the wildcard of someone throwing away the nginx 0-day just to be funny.

> there's no "one exploit pwns all"

I think what he's saying is if you had that, you certainly wouldn't use it on a known honeypot for 500 bucks.

Correct me if I'm wrong but isn't every PHP RCE... 2 shell?

Very well said. This is one of the most unintentionally hilarious posts I’ve ever read on HN.

80h ago we had no info other than a vague post from the php page saying a massive security flaw will be announced tomorrow. And a post from a PHP core dev saying shut it all down.

Everyone with inside info was sounding the alarm so the rest of us had to take it incredibly seriously.

You, the white-hat hacker would be concerned that your attack exploits payload will be logged either by the potentially malicious site operator who could be using this to gather various working exploits, or by other bad actors who already exploited the site before you. Unless your exploit itself is already well known and fully public that is.

This is a server that allegedly has some BTC on it (AFAICT it’s just a claim made by the website itself, zero corroborating evidence), definitely nothing else valuable, and likely has a lot of monitoring to capture whatever exploit you send, and with a less-vulnerable-than-usual setup. Unless you’re really desperate for the money and want to take a gamble on the server having the not very meaningful bounty it says it has, it’s strictly negative value compared to the average production php server that’s still unpatched. If I have a working exploit I’m mass deploying against everyone, I too would skip this one, similar to how mass market malware tends to disarm itself when it detects security research tooling.

No, I don’t think actual working exploit is trivial either, but people are wayyyy overselling this stunt in this thread.

These grapes are exceptionally low hanging and perfectly not sour, but I will not deign to pick them even though I could obviously.

Ive been pretty skeptical of your coverage as well, and you're in the OpenAI daybreak program and huffing and puffing about how great OpenAI is while having 900k subs, seemingly only talking up OpenAI products...

OpenAI and others are infesting the influencer space with what is basically dark money, not saying you're one of the guys on the take but I just don't trust any large influencer atm who only talks positively about OpenAI (or any lab).

I guess you can prove us AI cyber doubters all wrong with this CtF tho.

It cannot even show that. The server can lie (trivially).

Sure. Also, we have to trust owner of the site. So it cannot show anything, strictly speaking. Still, it maybe puts a price on exploit demo. Some say "it goes around twitter", "bots are probing and exploiting it", "it's a biggest thing ever in cybersec history, invest in AI now". Some say "it's a fud".

Are these 500$ laying on a ground for anyone to take?

dunno. Isn't LAMP a common PHP stack?

This is easy to exploit for example: `docker docker run -d --rm -p 0.0.0.0:80:80 wordpress@sha256:c96e9e9a8ead2fea02f05469b356134da45681aaefa0f961a87653d58c462794` (basically `wordpress:7.1.3-php8.5-apache` with vulnerable php version 8.5.11)

Well usually you have a PHP application actually doing something, not just serving static files. If it's just static files, PHP2Shell isn't really a thing.

I have no idea how I have lived this long, having the career I have without knowing this existed.

Now if I find a $100 in a dumpster, that's a different story...

Let's also try to figure out if smoking causes cancer, yes.

Right, It would be simpler for an attacker to post a link themselves with the virus, rather than hack someone elses post

If I hack a server, the first thing I'm gonna do is lock everybody else out, including the owner. At least in this particular case. In normal breaches, you need to keep being stealth for as long as possible, of course.

  $ curl -sS -D - -o /dev/null -X FOO https://stealmybitcoin.com/
  HTTP/1.1 501 Not Implemented
  Server: nginx
  Date: Sat, 24 Oct 2026 22:06:58 GMT
  Content-Type: text/html; charset=UTF-8
  Content-Length: 495
  Connection: keep-alive
  Host: stealmybitcoin.com
  X-Powered-By: PHP/8.4.26

Fingerprinting for the PHP version, a proxy will tell you what it is most of the time as well.

  curl -sI http://stealmybitcoin.com/
  HTTP/1.1 301 Moved Permanently
  Server: nginx
  Date: Sat, 24 Oct 2026 22:01:11 GMT
  Content-Type: text/html
  Content-Length: 162
  Connection: keep-alive
  Location: https://stealmybitcoin.com/

This is where I am, currently. There's a lot of talk about the low opportunity-cost here, but I think that relies on the assumption that there also isn't a single opportunistic person out there with access to the RCE. That doesn't strike me as a strongly supported assumption, in my experience.

For all I know, it's a straight up scam. Someone already sent more bitcoin to the address to double the bounty.

> Surely the probability is much higher than 0

I genuinely have no idea how to even start calculating this probability. How would we do it? Is there reliable data on honeypots?

Your giving away the exploit though so it's not really only $1. How much is having it actually worth, probably more then that, probably more than $500 too.

I don't indulge in vibe coding shenanigans but seems like the latest pull request would point any AI model where to look.

"hey AI, here's my patch for a very critical RCE bug. please test my localhost if it's fixed" secretly uses vulnerable php for localhost

thank me later

“Yeah, buy 8 h100’s and run it locally”, (800k of hardware).

They should consider donating to the PHP Foundation

Any exploit might be interactive with a backend component that generates and serves payload components based on interactive responses.

OP (and anyone else who exploits the server) would be able to see the transcript between the backend and the vulnerable server, containing the payload customised for the server, but not the actual code of the backend. This would be useful if it was a 0day vulnerability, but with a disclosed vulnerability getting a payload that doesn't work except on their server, without the code that generated it, might not be that much value over what they already have.

That said, there are other ways to scam by structuring things like the OP (none of this should be taken to imply the OP has actually done this, but rather why this structure as a general approach might be a bad idea):

* This could be a 'stone soup' scam where the OP has the wallet keys (obviously), and puts this up to bait the addition of more funds into the wallet by other interested people. The key might not actually even be on the server, or it might not be vulnerable. Once sufficient other people add funds, the OP could withdraw the funds, recouping their original funds plus anything others added. * This could be run as a propaganda scam either to falsely sell that it isn't an easily exploitable vulnerability when it is (by making it unreasonably difficult to exploit compared to real-life deployments), or to over-inflate how exploitable it is (by an insider withdrawal from the wallet). Manipulating public opinion could allow an attacker with a working exploit more time, or help to sell services to fix the problem.

I think an alternative scheme that is less vulnerable to scams would be to have a ZKVM (Risc0 or similar) executing vulnerable code, such that the attacker needs to produce a zero knowledge proof transcript of getting the ZKVM into a particular state that would not be possible if they didn't have an exploit. It should also take an Ethereum address as a public input. Then write an Ethereum contract that will allow funds to be transferred to the public input Ethereum address if submitted with a valid proof transcript, and back to the source of funds after some time has passed. Everyone who wants to add to the jackpot could deploy their own version of the contract, so the one proof transcript could claim from all of them, but if unclaimed the funds go back to the source.

Alternatively (avoiding the risk exploits may be so large as to make the cost of producing the proof transcript impractical), they could be built using a public cloud provider's trusted computing offering (e.g. Google Confidential VMs). The person making the challenge could make it so the derivation (NixOS for example) to produce the entire image executing on the cloud provider in a deterministic way (with publicly known source, and hash codes of each stage publicly available). Then, from the code with the known hash, they use the vTPM to generate an attestation that a key was generated while the vTPM PCRs were in a known state (corresponding to the publicly reproducible hashes), and ensure the only way to access the key from the instance is via an exploit. It would also include logic to generate and wrap a Bitcoin wallet key, and emit the public key (with the attestations and a signature linking back via a vTPM attestation to the cloud provider's key). This way, unless the cloud provider is also in on the scam, people could be assured that the OP isn't scamming them.