Observations from Running stealmybitcoin.com
Last week, I read a New York Times article about a critical PHP vulnerability known as PHP2Shell. The vulnerability allowed attackers to gain arbitrary remote code execution through unauthenticated web requests. Many in the security community were alarmed, fearing widespread exploitation of PHP-based websites. I decided to test the exploit myself by setting up a vulnerable PHP website on a cheap VPS and offering a bitcoin reward for successfully extracting a wallet key.
Within hours, my website was featured on Hacker News, leading to a flood of traffic and exploitation attempts. After 10 hours of logging, I observed over 2,600 PHP server errors and over 250 successful print-flag executions, indicating that tens of thousands of players had attempted to steal the bitcoin. The exploit was found to be particularly challenging in practice, with only two successful extractions out of tens of thousands of attempts.
Written by urgent.news from Lobsters's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
