Hacker Demonstrates PHP code to be run remotely in StealMyBitcoin Challenge, Shares Exploit

What happened

This proof-of-concept (PoC) exploit illustrates how specially crafted HTTP requests can trigger memory corruption, disclose internal PHP addresses, and execute commands on a vulnerable server.

Example output from the researcher’s local test includes: [health] PHP 8.4.26 confirmed [heap] strict Zend base 0x78113e800000 [code] strict zval_ptr_dtor 0x615b1f512930 {"stage":"final","execution_proof_verified":true} The published PoC requires Python 3.11 or newer and does not need any third-party dependencies. CVE/vulnerability Cyber Security News PHP 2 min.

The researcher, using the GitHub username KillaBoi, published the exploit (a piece of code that turns a flaw into a way in) in a public GitHub repository and detailed an attack against PHP version 8.4.26. This demonstration follows the disclosure of two critical PHP vulnerabilities, CVE-2026-109618 (the public catalogue number for a specific software flaw) and CVE-2026-109619 , collectively known as PHP2Shell.

Both vulnerabilities carry a CVSS v4.0 score of 9.2 and may allow unauthenticated remote code execution (running programs on a machine from somewhere else) under vulnerable conditions. PHP RCE Exploit The exploit specifically targets PHP’s session upload-progress handling and memory management.

According to the researcher’s documentation, a specially crafted multipart/form-data request forces PHP to allocate significantly more memory than the request’s actual size. The attack employs deeply nested form-field names to exhaust PHP’s configured memory limit of 128 MiB, potentially leaving stale session-related data inside a reusable worker process.

The researcher constructs a forged PHP HashTable containing a manipulated destructor callback.