LiveOverflow digs into stealmybitcoin.com CTF, suspects PHP2SHELL challenge is deliberately unexploitable
matthew_d_green · x · 2026-10-26
Security researcher LiveOverflow analyzed the stealmybitcoin.com CTF, which bounties roughly $2,012 in BTC to demonstrate that PHP2SHELL vulnerabilities aren't realistically exploitable.
- Response headers show nginx + PHP/8.4.26; differential fingerprinting independently confirmed PHP 8.2+
- After comparing against local test setups (nginx→PHP-FPM, nginx→Apache→PHP-FPM/modphp), behavior best matches nginx→PHP cli-server
- Key finding: responses look like the cli-server serving a static index.html rather than index.php — meaning the challenge may be intentionally unexploitable
- The challenge page shows a hidden bitcoin key worth $2,012, unclaimed after 14+ hours. Author notes his analysis could be wrong
More from Safety
- Georgia officials: Anthropic-linked bot scraped public voter data, didn't touch registration system — asusarla · 2026-10-26
- PHP WASM servers show no sign of PHP2SHELL impact so far, patch in progress — MickeySteamboat · 2026-10-26
- Apple's week-long curl/git CA bundle lag sparks developer security debate — kingslyj · 2026-10-26
- LLMs and the Law: training doesn't make a model a derivative work, FAQ explains — esrtweet · 2026-10-26
- OpenAI's Daybreak Blue isn't hard for individuals to get — just set up a hardware key 2FA — pvncher · 2026-10-26
- Research agenda for multi-agent swarms: 7 open alignment problems — ZhijingJin · 2026-10-26