Yet another Hacker News

185 points cloudlandsdev 1 hour ago 60 comments

Made this because I'm curious if anyone out there has figured out how to actually use this PHP RCE we spent the last few days panicking over. Have fun!

TacticalCoder 1 hour ago | parent

Nice CTF! I hope if it's captured by a LLM we'll get a write up as to how it did it.

sashank_1509 1 hour ago | parent

You have to be really confident that the PHP RCE is not anything serious, 500$ is quite a bit?

anonymous908213 1 hour ago | parent

It's more like they're offering $500 to be taught how to utilise the exploit.

jgilias 1 hour ago | parent

There’s a lot of techies on this site for whom that’s peanuts.

MarcScott 1 hour ago | parent

They should consider donating to the PHP Foundation

quesera 46 minutes ago | parent

I'm sure OP is a good person.

But if they were not, and had ill intentions, they might see $500 as a very inexpensive way to purchase a working exploit to use against others.

hau 1 hour ago | parent

That's a good way to make claims about existence of a trivial exploit in the wild falsifiable.

akerl_ 1 hour ago | parent

A reminder that this cannot falsify the existence of an exploit, trivial or otherwise.

It can only show you if someone has used an exploit against this server.

muvlon 56 minutes ago | parent

It cannot even show that. The server can lie (trivially).

tylergetsay 18 minutes ago | parent

The block chain can't though once the coins are transferred

akerl_ 16 minutes ago | parent

That assumes the key is actually on the server.

hau 52 minutes ago | parent

Sure. Also, we have to trust owner of the site. So it cannot show anything, strictly speaking. Still, it maybe puts a price on exploit demo. Some say "it goes around twitter", "bots are probing and exploiting it", "it's a biggest thing ever in cybersec history, invest in AI now". Some say "it's a fud".

Are these 500$ laying on a ground for anyone to take?

earthpyy 1 hour ago | parent

Interesting idea! Would like to know how much time need to spend.

nayuki 1 hour ago | parent

The server is getting overloaded, so here's the text for reference:

    Steal my Bitcoin
    0.65 hours without a successful hack
    
    There is a bitcoin key hidden on this server worth about $502.
    
    It is accessible to the PHP user account through the print-flag binary.
    
    This PHP version was selected from before the PHP2SHELL CVEs were released.
    
    First person to get the wallet wins. If you don’t need the money, consider donating it to those who do: givewell.org.
    
    All traffic is logged. This is a known vulnerable machine, so we cannot guarantee privacy. Other attackers may access or monitor activity and data beyond our control. Do not submit anything you want to keep private.
    Challenge wallet
    Explorer ↗
    
    bc1qlnu5…t3cxqy
    
    0.00625104 BTC
    
    ≈ $502.35 USD
    stealmybitcoin.com · Terms of participation

zoeysmithe 44 minutes ago | parent

" All traffic is logged."

For $500 he can look in the logs and find all manner of new exploits, or new deviations of the existing ones, he can then sell for thousands. Clever business model lol

These projects would be more interesting and ethical if the current and historical logs were instantly put up somewhere public in real-time for anyone to observe.

Regardless, I'm guessing the smart hackers aren't going to bother.

datadrivenangel 41 minutes ago | parent

Author is a genius troll.

fwlr 33 minutes ago | parent

Great way to inject some price information into the “AI automates exploits at scale” narrative. “AI can now chain complex exploits, it’s point-and-click pwnage, you say? Over or under $500 a pop?”

flir 20 minutes ago | parent

$500 is the value of the prize. We don't know what the price someone will pay for a lottery ticket is.

fwlr 9 minutes ago | parent

It’s not very much information, I agree. Even such scant information, however, is a significant and refreshing improvement on the current state of the narrative. Kudos to the servermaster, I say.

snailmailman 15 minutes ago | parent

I'm seeing a few comments that say $500 isn't enough, and its not worth it for them to try to hack it. But if it costs fewer than $500 of tokens in an AI, then it seems like it is? I thought a lot of the claim people are making is that you dont actually need to hack anything you just ask an AI and it does it. The exploitable bug is public and documented. All the pieces are theoretically there, and there are repeated claims that AI is trivializing exploits and its super easy to hack things now.

If that were true, and someone can hack the server for less than $500 of tokens, its an easy profit.

jackdecker 59 minutes ago | parent

Made tough here as you’re behind nginx w/ a 1MB request body cap! Sweet idea :)

jerrythegerbil 57 minutes ago | parent

This will go unclaimed for a bit. It may still get claimed within the day, but

People do have the exploit. The risked opportunity cost of this being a honeypot (and handing over a functional exploit) vs just… not participating and hacking higher value targets (offensive actors) or not circulating any additional details (defensive actors who have privileged intelligence about the vulns) I just…

The value proposition here is so hilariously low for what is required to demonstrate stealing the bitcoin at all.

That doesn’t mean that people won’t try, and perhaps even succeed! But to what end? Demonstrating terrible math skills and a fundamental misunderstanding of the economics at play?

I, and many of my friends and cooks could take this easily. The difference is we know not to.

Make it $15-25k and it’ll get yoinked instantly.

phyzome 44 minutes ago | parent

It's worth it to someone.

cassonmars 41 minutes ago | parent

I suspect this is going to be more a point about the fact that most PHP server configurations do not have the ability to be exploited by the recent vulnerability that made people think the AI vulnpocalypse was here

fwlr 41 minutes ago | parent

If the actual price tag behind the “AI can trivially automate exploits, be afraid” narrative is more like $15,000 and not like $150, that puts the narrative in a very different light.

msm_ 38 minutes ago | parent

>and handing over a functional exploit

There are dozens (or hundreds) of functional exploits already. The problem with php2shell exploits is that (as of now) there's no "one exploit pwns all", and researchers need to spend nontrivial amount of time on every (potentially) exploitable target.

So I don't think I agree - it's a fun challenge for the itsec people around here, and some people will definitely try. There's no real opportunity cost here. The only problem is that (as of now) exploiting PHP requires some knowledge about the server configuration, and we don't have that here.

tofuahdude 38 minutes ago | parent

> But to what end?

It is just kind of fun to poke at something like this.

> Demonstrating terrible math skills and a fundamental misunderstanding of the economics at play?

I don't give a shit about the $500, nor would I ever attempt actually hacking something that wasn't explicitly a game (like this).

> The difference is we know not to.

Borrrrinnnggggg

fishgoesblub 34 minutes ago | parent

> I, and many of my friends and cooks could take this easily.

Sure you can.

oofbey 22 minutes ago | parent

> a fundamental misunderstanding of the economics at play

I’d say you’re the one who doesn’t understand the economics at play here. To me and I’m guessing the OP it’s quite simple. Have the exploits become common/simple enough to be worth $500 yet?

thenewnewguy 18 minutes ago | parent

Can you spell out the economics for us?

Let's assume I am a white-hat hacker with access to this allegedly widespread exploit. Obviously, I understand why a nation-state attacker wouldn't want to share their exploit here but what do I as a random citizen stand to lose? It's not like I care about hoarding the exploit to pwn innocent civilians.

You seem to imply there's some economic reason such a white-hat hacker wouldn't take the $500 but don't actually say what it is.

lukeify 4 minutes ago | parent

What an insufferable comment. For all the hullabaloo discussing the economic value of time about $500 being an insufficient prize, you still spent what I can only assume is several minutes penning a comment that derives you zero economic value whatever.

randomblock1 54 minutes ago | parent

It runs PHP 8.4.26 (and nginx). Might be useful for others.

LZ2DMV 15 minutes ago | parent

I'm a bit curious how you found that.

selfmodruntime 12 minutes ago | parent

Fingerprinting for the PHP version, a proxy will tell you what it is most of the time as well.

  curl -sI http://stealmybitcoin.com/
  HTTP/1.1 301 Moved Permanently
  Server: nginx
  Date: Sat, 24 Oct 2026 22:01:11 GMT
  Content-Type: text/html
  Content-Length: 162
  Connection: keep-alive
  Location: https://stealmybitcoin.com/

randomblock1 4 minutes ago | parent

  $ curl -sS -D - -o /dev/null -X FOO https://stealmybitcoin.com/
  HTTP/1.1 501 Not Implemented
  Server: nginx
  Date: Sat, 24 Oct 2026 22:06:58 GMT
  Content-Type: text/html; charset=UTF-8
  Content-Length: 495
  Connection: keep-alive
  Host: stealmybitcoin.com
  X-Powered-By: PHP/8.4.26

primer42 53 minutes ago | parent

If someone did have a working exploit, is $500 enough for them to give it away to whomever is monitoring this honeypot?

Stevvo 47 minutes ago | parent

You have not proven the key really is on the server. From a game-theory point of view I have no reason to believe it is there, and thus no reason to attack.

rafram 21 minutes ago | parent

Not sure that logic really holds up. If the cost of trying is low, why wouldn't you?

v3ai 15 minutes ago | parent

what a pedantic way to look at the world

zulban 14 minutes ago | parent

You may need to brush up on your game theory. It's worth it to spend $1 for a 1% chance to win a million dollars. You don't need to be certain the key is there for it to be worth it to do a supposedly trivial exploit.

sgarman 10 minutes ago | parent

Your giving away the exploit though so it's not really only $1. How much is having it actually worth, probably more then that, probably more than $500 too.

LandoCalrissian 46 minutes ago | parent

I love it, very fun.

tamimio 45 minutes ago | parent

$500 isn’t worth the time, make it at least $5k then we talk.

datadrivenangel 41 minutes ago | parent

Appreciate the commitment to the bit!

impure 40 minutes ago | parent

I was wondering how exploitable this was. I will definitely be watching.

rvba 39 minutes ago | parent

this should be done on one of those barebone servers that run on an 8bit commodore or an atari (self identifying as something else)

qbane 33 minutes ago | parent

I remembered that there was a similar challenge for Heartbleed.

technion 23 minutes ago | parent

There is a lot of cynicism in this thread but the fact this is still open and hour later ends the narrative in my view. There are not "thousands of swarms of agents autonomously compromising every site for its authors" or any the other x / LinkedIn dribble ive been reading.

It clearly isnt happening.

jackphilson 2 minutes ago | parent

Yeah, AI seems like a good shift in "narrative making." It's easy to ask AI "give me an efficient way to "confirm or deny this narrative" and have something like this go viral. This is good because it makes narratives more truthful

v3ai 21 minutes ago | parent

major pain in the neck that anthropic doesn't let opus 5.5 work on this, goes back to 4.8 lame

cluckindan 16 minutes ago | parent

Just run GLM-5 locally, if people are to be believed it can hack the planet at this point

Izmaki 19 minutes ago | parent

This has to be the cheapest way to obtain a working POC. Lol!

int32_64 16 minutes ago | parent

It could be an interesting cybersecurity technique to hide obvious crypto private keys all over.

If it gets swept you are breached.

hoppp 2 minutes ago | parent

Yeah, just keep dust in it. Like $10

freecodeio 7 minutes ago | parent

can't people just point their AI to the latest pull request that includes the fix and ask it to deduce the vuln?

grey-area 4 minutes ago | parent

Please do and report back here.

LPisGood 2 minutes ago | parent

People could point their AI at a physics textbook and ask it to deduce the vuln from first principles too but that doesn’t mean it will be successful.

echoangle 1 minute ago | parent

If the AI can build an exploit from the patch, sure.