Hacker claims $2,021.22 Bitcoin bounty by exploiting unpatched PHP servers

$2,021.22 Bitcoin bounty for exploits unpatched PHP servers. (claimed by hacker 'KillaBoi') Why this matters: We see that even patched security flaws are still vulnerable to exploits. It's easy to think that the patch would make it inaccessible but this challenge shows it's not the case.

PHP2Shell challenge proves manual exploits still work despite AI hype

Challenge: exploit CVE-2026-109618 CVE-2026-109619. These are critical PHP remote code execution flaws.

The PHP test server has not been patched even though patch was issued on October 21. This gave enough time for attack.

How the exploit works: The exploit exploited PHP multipart upload and PHP session. Memory corruption takes place. Because the PHP worker was given too much memory, its internal state is left in a bad state.

The exploiter then manipulates forged PHP data structures to run commands at cleanup. "cloudlandsdev" who made the challenge wanted to see if this PHP RCE can be exploited easily with the help of AI. Last couple of days I was in a panic trying to see if somebody can actually utilize this PHP RCE. as cloudlandsdev mentioned. The exploit shows that good old manual exploits still work for these flaws.