A security challenge involving an unpatched PHP server concluded after a successful exploit. The project, initiated by a user known as cloudlandsdev, aimed to test the practical application of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which allow for remote code execution.
The bounty for the challenge began at approximately $502 in Bitcoin and grew to 0.02511679 BTC, valued at $2,021.22 at the time of the claim. The server was compromised at 15:47 UTC on October 25, roughly 19.28 hours after the challenge was launched.
The attacker executed a command by creating a forged PHP data structure that triggered during the cleanup process. While the server was successfully breached, the private key recovered did not match the prize address, though on-chain data indicates funds were moved to a Kraken cold wallet.
The experiment highlighted the difficulty of managing server resources during high-traffic security tests, as visitors frequently exhausted available computing power. The vulnerabilities, collectively referred to as PHP2Shell, had official patches released on October 21.
