# Bitcoin Challenge Tests Whether PHP Flaws Can Expose a Hidden Key By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/40630 Published: 2026-10-25T17:52:06.000Z Updated: 2026-10-25T17:52:06.000Z Section: Technology > The server’s PHP 8.4.26 version predates the fixed 8.4.27 release, but the setup details do not establish that the challenge can be exploited. A public security challenge is testing whether users can use two recently patched PHP flaws to retrieve a hidden key from a server running an older version of the software. The test centers on PHP2Shell, a pair of vulnerabilities that can allow remote code execution under certain conditions. Steal My Bitcoin gives the PHP user access to a print-flag binary that reveals the key. Its maker, posting as cloudlandsdev, said the challenge was created to see whether anyone could use the newly disclosed flaws in practice. “I'm curious if anyone out there has figured out how to actually use this PHP RCE we spent the last few days panicking over,” cloudlandsdev wrote. An initial page snapshot displayed a reward of 0.00625104 BTC. The address associated with the challenge later held 0.02500416 BTC; that balance was not identified as the maker’s advertised prize. After commenters questioned whether the site was running PHP, cloudlandsdev added a version endpoint. The server was running PHP 8.4.26. The maker said the PHP container used default settings without special hardening, while the host had some hardening. “Nothing turned off and no special hardening over a default php setup within the container,” cloudlandsdev wrote. The PHP project released fixes for CVE-2026-109618 and CVE-2026-109619 on Oct. 21. Fixed versions include 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both flaws are rated 9.2 out of 10 under CVSS v4 and can enable unauthenticated remote code execution on PHP installations serving web requests. A version number below a fixed release does not establish that a particular server is exploitable. The vulnerabilities’ exploitability depends on the runtime, configuration and request path, so the challenge reflects one server setup rather than exposure across PHP deployments. The flaws concern PHP web infrastructure that crypto platforms may use, a risk addressed in [coverage of the PHP fixes](). The challenge focuses on whether a hidden key can be retrieved from this particular server. ## Links in this article - [coverage of the PHP fixes](https://www.tokenpost.com/news/technology/37442)