Two Critical Holes in PHP Itself

PHP 2 shell refers to two critical vulnerabilities in PHP, tracked as CVE-2026-den-1618 and CVE-2026-den-9619. Both carry a critical score of 9.2. An attacker on the open internet can run code on a web server with no login required.

Patches shipped on October 21 for PHP 8.5.12, 8.4.27, 8.3.6, and 8.2.35. PHP 8.1 and older receive no fix from the PHP project. According to W3Techs, PHP powers about 69% of websites where a server-side language can be detected. A census counted more than 41 million PHP services still showing affected version numbers, making the exposed surface enormous.

A third issue, CVE-2026-1115-560, remains unfixed by the October 21 patches. Vendors such as AWS have advised a settings change that includes turning off PHP’s upload progress feature. As of CESA’s October 23 update, no successful attack in the wild had been observed.

What the Internet Got Wrong

Once the holes became public, GitHub filled with purported working exploits. Many of these were AI hallucinations. Security researcher Marcus Hutchins highlighted the same fake technique appearing across multiple repositories. That older method relied on a session upload progress attack from years earlier. It shared a feature name with the real chain but constituted an entirely different attack and was not PHP 2 shell.

The actual chain differs. According to the winner’s own write-up, the attack broke PHP’s memory during the upload progress step, leaked two hidden memory addresses, and then forged fake PHP data to take control of the server. Upload progress therefore forms part of the genuine sequence, yet it is not the old session trick that people copied into ChatGPT.

The Steal My Bitcoin Challenge

The operator left a real Bitcoin prize on an unpatched PHP 8.4.26 server. The pot began around $500 and grew through donations to about $2,021. Early on, the site could not be won at all because it served only plain HTML. Once the operator added a real PHP page, the fair clock started. The site was claimed after 19.28 hours, at 8:47 a.m. Arizona time on October 25.

Fence, the WordPress security company, outlined the precise steps required. The winner had to corrupt memory at exactly the right moment, leak two secret addresses from the server, defeat the protection that shuffles where code sits in memory, and forge fake PHP components to hijack the system. In the winner’s own lab, the technique needed at most 20 web requests and succeeded roughly seven times out of ten. It worked only on that exact server build. A Debian system reporting the same PHP version string failed because its memory layout differed; no shell was obtained.

A final plot twist concerned the money itself. The key stored on the server did not match the funded wallet. The winner still recovered the correct flag, and the operator paid the prize anyway, confirming confidence that the solve was genuine.

Hard Is Not the Same as Safe

The exploit proved very difficult for amateurs yet possible for one skilled person. Difficulty does not equal safety. The winner published a write-up, giving the next operator a map. Meanwhile, floods of fake proofs-of-concept can leave teams numb just as a real attack arrives.

Anyone running PHP on the open internet should check whether their server remains on a version that still allows unauthenticated code execution. Recommended actions include patching to PHP 8.5.12, 8.4.27, 8.3.6, or 8.2.35 and restarting the workers. Systems still on 8.1 or older should be removed from the open internet until they can be upgraded. Random AI-generated exploit repositories should be treated as guilty until proven otherwise. Settings related to the third bug deserve review, and teams should not wait for GitHub star counts before acting.

Moving from Awareness to Action

This episode illustrates why security cannot remain an afterthought while teams ship quickly. Founders focused on product-market fit often move fast with code, yet familiarity can create blind spots. A single SQL injection, exposed secret, or broken access control can place a company in the news for the wrong reasons.

Startuphakk Security offers practical starting points. Two free AI-powered services deliver engineer-verified findings within an hour. The AI site scan accepts a URL and runs non-destructive, security-focused playbooks against the live attack surface, looking for injection flaws, broken access controls, cross-site scripting, and open redirects; the free tier returns the top three highest-severity findings with evidence. The AI code scan review accepts a zipped codebase (no GitHub access required) and examines every file for hard-coded secrets, vulnerable dependencies, injection flaws, and broken access control; the free tier again supplies the top three issues plus clear remediation guidance. Both run on a private AI harness rather than a public cloud service.

Automated scans catch low-hanging fruit quickly, yet they do not replace humans who think like attackers. When deeper work is required, engineer-driven penetration tests, architectural assessments, real attack simulations, and prioritized remediation roadmaps address the risks that matter when money or compliance is at stake. Security, handled correctly, need not slow progress; it can become the reason teams move faster without constant concern.

The PHP 2 shell story shows both the difficulty of a high-end exploit and the continuing size of the vulnerable population. Checking versions, applying available patches, and verifying settings remain the immediate steps for anyone still exposed.

Conclusion

The Bitcoin challenge showed that PHP 2 shell is difficult but not impossible once the right conditions and skill are present. The large number of still-affected services, the gap between fake public exploits and the real chain, and the existence of a published write-up mean the practical risk remains real for anyone still exposed. Patching the supported versions, removing older PHP from the open internet, and verifying related settings are the direct steps the situation calls for.