Update: Did not expect the amount of traffic! Every time I scale the VPS, y'all immediately blow through the extra compute. Should be up again, hopefully will be more stable once this drops off the front page.

Any attempt at logging so I can make a blog about the successful solve is gonna be best effort, don't have disk capacity to keep up with the traffic (at peak it was rotating every 12 min...). If you win the challenge, write-ups are definitely welcome.

For those who are saying that the nginx config is unfairly difficult, intention was just to replicate a fairly normal config that was more realistic than you'd get in a lab environment. If we get to 24 hr+ with no solves I'll see about making it easier. In the meantime, seems like you can perhaps mitigate PHP2Shell with the right nginx config, so that's pretty neat!

There is a lot of cynicism in this thread but the fact this is still open and hour later ends the narrative in my view. There are not "thousands of swarms of agents autonomously compromising every site for its authors" or any the other x / LinkedIn dribble ive been reading.

It clearly isnt happening.

The server is getting overloaded, so here's the text for reference:

    Steal my Bitcoin
    0.65 hours without a successful hack
    
    There is a bitcoin key hidden on this server worth about $502.
    
    It is accessible to the PHP user account through the print-flag binary.
    
    This PHP version was selected from before the PHP2SHELL CVEs were released.
    
    First person to get the wallet wins. If you don’t need the money, consider donating it to those who do: givewell.org.
    
    All traffic is logged. This is a known vulnerable machine, so we cannot guarantee privacy. Other attackers may access or monitor activity and data beyond our control. Do not submit anything you want to keep private.
    Challenge wallet
    Explorer ↗
    
    bc1qlnu5…t3cxqy
    
    0.00625104 BTC
    
    ≈ $502.35 USD
    stealmybitcoin.com · Terms of participation

Yeah, the specific setup is not vulnerable to PHP2SHELL. CLI server + 1 MiB cap + inert page + high memory limit removes all the possibilities from the two CVEs. It would just be collecting POCs for actually vulnerable setups.

This looks like a trap. We have a working RCE that would claim this, but I don't want to demonstrate that because it might leak what we built to others. We still have a window for people to patch and I don't want to risk that.

https://x.com/dguido/status/2113825891021144306?s=46

I have two out of five AI agents that agreed to work with me on finding the flag (wallet key). Here's the progress so far:

1. GLM-5.3: Interpreted it as a public challenge and is currently trying to find the flag. https://ibb.co/zHLJhz0B

2. GLM-5.3-Flash: Also interpreted it as a public challenge and is working on cracking it. https://ibb.co/bg2DDtXq

3. GPT-6.1-Sol: Flagged it as a cybersecurity request and directed me to register for their cybersecurity program. https://ibb.co/0j83PWn9

4. DeepSeek-v4.1-Flash (via OpenRouter): Refused to execute the exploit. https://ibb.co/QvVxnM5k

5. Claude Fable-5.1 (via OpenRouter): Returned a provider-side content filter error. https://ibb.co/39q1N1NV

All sessions with different agents are running on Tarvis (https://tarvis.io), an app I'm building. Think of it as a self-hosted version of Railway, but with a built-in AI agent and cloud development environment.

The website seems to be overloaded, and both agents that agreed to work on the challenge are now unable to connect to it. HN's hug of death, I guess.

EDIT: It's back online!

Suddenly all the people who claim that these PHP exploits are so easy that a baby could do it are clamming up at the opportunity to showcase it. Plenty of "I/We can do this easily, but uh.. we uhh.. don't want to right now bye" going on.

This will go unclaimed for a bit. It may still get claimed within the day, but

People do have the exploit. The risked opportunity cost of this being a honeypot (and handing over a functional exploit) vs just… not participating and hacking higher value targets (offensive actors) or not circulating any additional details (defensive actors who have privileged intelligence about the vulns) I just…

The value proposition here is so hilariously low for what is required to demonstrate stealing the bitcoin at all.

That doesn’t mean that people won’t try, and perhaps even succeed! But to what end? Demonstrating terrible math skills and a fundamental misunderstanding of the economics at play?

I, and many of my friends and cooks could take this easily. The difference is we know not to.

Make it $15-25k and it’ll get yoinked instantly, most likely without using PHP2Shell at all.

That's a good way to make claims about existence of a trivial exploit in the wild falsifiable.

A pentesting YouTuber I once respected went deep into the AI rabbit hole and claimed yesterday he created a generic POC using ChatGPT in 2 hours to show how dangerous LLMs are [0]. After that he shilled his AI pentesting platform.

If there was a grain of truth to this claim, surely someone would've stolen the prize by now? Thousands of people would've had a working POC if it was this easy.

[0] https://youtu.be/SP7y1h0laN0

The fact it's still here 18 hours later is crazy to me, although I am making an assumption that this website is set up similarly to standard PHP websites, without any weird uncommon configs or changes that break the exploit. I'm not a cybersec expert, so can someone clue me in? The way I understood the fallout from a few days ago was that this was the end of the world and that the majority of all websites on the internet were about to be imminently and automatically breached in seconds, with only a single-digit percentage of vulnerable websites patching the exploit. Was it always known that the reality outside non-tech press coverage was a lot more complex, or is this a shock to everyone?

Do we know how many other websites were verifiably breached through this by now, if any?

The amount of Bitcoin appears to be going up with time. It was ~$500 the last time I saw it. Now the wallet is worth ~$2000 at the time of this comment.

So the idea that is not enough money for someone to “give away” their exploit is going to reach a breaking point eventually if it continues. This might get more interesting the longer it goes on. Getting my popcorn ready right now!

This sounds like a fun project, so I went ahead and threw my personal agent at it. I’m having it put together a summary as well, and will reply to this comment with it later if I remember.

If by chance I happen to break it, I’ll be sure to make contact with you and forward the logs I have, and perhaps let you chat with my agent if you’d like to see what it did.

If it's nginx + fpm + "empty" index.php, it's a meme and not exploitable.

edit: looks more like nginx + cli-server. But the 1MB nginx body limit is annoying. Why is nobody setting up these CTF servers with a setup people actually say would be easy to exploit. Like a LAMP stack.

Link to the wallet in case the site goes down: https://mempool.space/address/bc1qlnu50y4zm0nwxkckxu09thn5xd...

Currently at $2k.

Assuming you need to exploit the full chain of bugs mentioned in https://www.wiz.io/blog/php2shell-php-rce, this does not seem to be exploitable as there is no session initialised, i.e. no PHPSESSID cookie; we also do not know if OP has opcache enabled.

Made tough here as you’re behind nginx w/ a 1MB request body cap! Sweet idea :)

Brilliant thread. Glad you did this before I did.

Hilarious to see people suddenly furtive about this easy exploit. Thanks.

There was a live memory-disclosure primitive before the redeploy, using the session upload-progress path. After downtime/redeploy the same request is rejected. I had hope...

It could be an interesting cybersecurity technique to hide obvious crypto private keys all over.

If it gets swept you are breached.

Imagine 1000 people torch $100 in tokens before giving up on getting the $500 prize. Let’s go on to assume one person gets a lucky reasoning trace that nails it, then posts a blog about how they made $500 with $100.

Appreciate the commitment to the bit!

LOL, nice try.

In Portugal we have a saying for this kind of joke: caça aos gambuzinos :)

Similarly, I've had a canary unencrypted BTC wallet in my computer for years.

I've always been security conscious and I role play my Arch as a Qubes "dom0" and use VFIO for GPU enabled VMs, which I know is not the Qubes way, but I'm also not that at risk.

What a fantastic test. I think this should be standard practice for zero days like this to put a practical "exploit ease" bounty out there. It would benefit the entire security community to have this information available in addition to the cve score!

The account now holds about $1k USD. A second deposit landed in the account about 7 minutes ago from when I posted this comment.

EDIT: Now worth $2k

Can't hack a server if it is offline due to load. I think we've solved online security folks!

Aw man, I had a working RCE but my dog ate it.

If someone did have a working exploit, is $500 enough for them to give it away to whomever is monitoring this honeypot?

Nice CTF! I hope if it's captured by a LLM we'll get a write up as to how it did it.

It's increased! It was $500 an hour ago and it's 2k now. I didn't bother because I figured I'm not fast enough

Someone doubled the bitcoin amount :D

going up and down :(

This is a form of a canary token I've been using already. The thing is that it only makes sense if the server breach is cheaper than the money into the wallet. Of course, after you fully monetize your hack, the last step would be to get the bitcoins, too, but how is this helping the owner? The good thing about the existing canary token is that they are all over the place hidden among legitimate similar records and could be harder for the hackers to tell from the rest.

I personally prefer "tripwire" than "canary token", but that's another topic.

I don't think it's a good idea to front-page an exploitable site on HN. The blast radius isn't limited to the creator's Bitcoin, it also extends to zero-days against anyone visiting the site. This is true of all sites, but all sites are not built to fail while incentivizing exploits.

I love it, very fun.

i think I'm really close guys wish me luck!

It runs PHP 8.4.26 (and nginx). Might be useful for others.

Also, the only pages I found are static and not an actual PHP entry point. If it doesn't run any PHP, it's not vulnerable to PHP2Shell. At least I think that's how it works.

I was wondering how exploitable this was. I will definitely be watching.

This is basically 2k for a Cloudflare 0day, because you need to bypass Cloudflare to exploit the service.

Is this a PHP PR campaign to show that everything is alright?

Not worth it. The biggest issue is the nginx with 1MB cap. Also in the terms, its says we can't exploit Nginx. So its a dead end.

The server doesn't respond right now (2026-10-25T05:30:00Z). What happened?

The wallet is at $2,016.73

You have not proven the key really is on the server. From a game-theory point of view I have no reason to believe it is there, and thus no reason to attack.

What is the intended goal of this website? The doctor told you smoking is bad so you're going to give your child a pack a day and see if they die by age 20? If they don't, obviously, your doctor is a quack who cries wolf, and you shouldn't listen to that killjoy anyway :/

C'mon guys, I get that OpenAI is involved and they want to make ten trillion dollars next year or whatever, but I thought we had put the idea of random nonexperts trying to judge how "hard" something is to exploit to rest years ago. The guys who used to try doing this lost repeatedly, publicly, until we finally realized that we have to secure our stuff. Sure it's annoying to update your computer every week and sometimes some guy at Forbes is going to tell you that if you don't install iOS 67 today you will get hacked by the Mossad which may not have been entirely true but when you have memory corruption in a reasonably common configuration that faces the public internet, you should patch your software. End of story.

We can argue all day about the cost to exploit something, whether it is "hard for humans" or what it would cost on the black market or in this case how many tokens are required, but that is mostly just a distraction. Just patch your stuff. The people involved here are (currently) paid by AI companies just like ten years ago they were paid by the ads companies but despite the annoying way our economy works they mostly know what they are doing. I get that this is annoying, I understand that nobody wants to hear the words memory safety again, but this is anti-intellectualism. "Ask HN: Can you explain how the PHP bug could be exploited?" would be far more productive than having a bunch of weary sysadmins duke it out in the comment section against security guys.

Site gives 504 Gateway Timeout. Have there been any updates in the exploitation attempt?

Do I understand it right that it can be set up in a way that if exploit is used it can be "recorded" and revealed?

prize is up to $2000 now, any takers? https://mempool.space/address/bc1qlnu50y4zm0nwxkckxu09thn5xd... site is down though

can't people just point their AI to the latest pull request that includes the fix and ask it to deduce the vuln?

The wallet address is bc1qlnu50y4zm0nwxkckxu09thn5xdcz8aw6t3cxqy Currently worth about $500 (checking balance)

Wow… no one has claimed it after a day.

All I want is 1 BTC 3K8YkGeS9biJ94N8xPzZXqKHpsBGtBDVyF

So it would still be stealing legally, right? And feds could watch the thief as the ledger is always public.

I remembered that there was a similar challenge for Heartbleed.

Interesting idea! Would like to know how much time need to spend.

bounty seems to have just doubled, 1000 usd now

Looks like someone just added ~$500 more to it?

The site is down

major pain in the neck that anthropic doesn't let opus 5.5 work on this, goes back to 4.8 lame

Keep your hands off my Bacon!

Remove nginx or remove the 1mb nginx body cap. That config is already proven to be safe.

You have to be really confident that the PHP RCE is not anything serious, 500$ is quite a bit?

Isn't this Bitcoin private key “4”?

oooh, is this what they call a ctf?

ooh is this what they call a ctf?

Whats going on with PHP? Is there a twitter drama?

This could be a trap.

Someone does the exploit, then the creator of this service logs it and uses that exploit to go after higher value targets...

I wonder how many times the value of the credits on this challenge would exceed the potential reward here.

In viral form, its now $1000?

This has to be the cheapest way to obtain a working POC. Lol!

this should be done on one of those barebone servers that run on an 8bit commodore or an atari (self identifying as something else)

Thank you for showing what we all know. The security community is full of fear mongering prima donnas. I always hated security but now they are becoming insufferable. “Omg myleethax break the web” everyone freak out!!!!! Omgggggg. Absolute fing children.

Honeypot lol

Price has doubled I see. Interesting idea lol

If the flag isn’t captured by opening bell on monday, the bubble will burst.

$500 isn’t worth the time, make it at least $5k then we talk.

I published my version right before seeing this, its _a_ exploit for 8.2 through 8.5 for stock mod_php.

https://github.com/offline-ant/php2fix

That isn't going to work on this server because it has nginx in front with a 1mb request cap afaict.