Pentester Exploits PHP2Shell Vulnerability to Claim $2K Prize

"My Bitcoin was stolen after 19.28 hours," the Steal My Bitcoin site now declares — a terse accounting of an experiment that both proved a high-profile exploit workable and underscored how messy real-world testing can become once a headline grabs the attention of the security community.

James Pavur’s capture-the-flag and the contested prize

On October 24, James Pavur launched a public capture-the-flag (CTF) challenge called "Steal My Bitcoin" to test claims about the PHP2Shell vulnerabilities. The CTF, the site and Pavur's intent were designed to let participants attempt Remote Code Execution (RCE) against a deliberately vulnerable target. The challenge was described in the announcement as offering a Bitcoin payout; the Register reports that Pavur's initial contribution was $500 and that the community later upped the award to $2,000. The same Register piece also says Pavur had promised to award $2,000 in Bitcoin to anyone who could achieve RCE.

How Jaydip Modhwadia — "Killa" — captured the flag

A UK-based developer and pentester, Jaydip Modhwadia, 26, who uses the handle "Killa," claimed the contest prize after achieving RCE on the challenge site. The site’s timeline is detailed in The Register: Pavur updated the site around 1300 UTC on October 25 to expose a PHP endpoint that the exploit requires, and Modhwadia achieved RCE at 1547 UTC that same day. Modhwadia told The Register he obtained the flag in "around three or so hours in total," and later published a write-up and a single-file Python proof-of-concept he says requires "at most" 20 HTTP requests to fully execute.

Technical constraints, early complaints, and a public outage

When Pavur first launched the CTF, prospective participants complained the page served only static HTML and therefore did not provide the PHP file that the PHP2Shell exploit needed as a hook. The endpoint Pavur later introduced was what allowed Modhwadia to complete the exploit. For hours, large numbers of bug bounty hunters attempted to access the site after the challenge gained wide notice, and Modhwadia said the entire site became "basically unusable" after it went popular. Pavur also set a 1MB request limit on Nginx for the challenge, a restriction that did not stop the surge of attempts against the target.

Exploit sophistication: ASLR bypasses and the limits of scale

Modhwadia's proof of concept is described in the Register as an advanced demonstration rather than a trivial exploit. Early analysis had suggested Address Space Layout Randomization (ASLR) on vulnerable servers would pose a significant barrier to reliable exploitation; Modhwadia’s solution bypasses ASLR, "along with the others that were disclosed recently," the article says. Security figures cited in the piece stressed that a successful CTF entry is not the same as a broadly automatable campaign. Alon Gal, co‑founder and CTO at Hudson Rock, commended Modhwadia but warned, "Does this mean autonomous AI agents can now compromise arbitrary PHP servers at scale? No. This was a sophisticated, target-specific exploit." Gal added that the demonstration still shows PHP2Shell can be weaponized against a live target even with meaningful technical constraints.

Broader signals: exploit code, mass scans, and defensive responses

Spencer McIntyre, director of exploit development at VulnCheck, told The Register that attackers are "clearly spending time (and tokens) on this bug," and that exploit developers continue to find new ways to weaponize PHP2Shell. The Register also reported that exploit code appeared online hours or days before the public disclosures, driving "millions of exploit attempts," though commentators said it was too early to assess how many of those attempts succeeded in the wild. In response, scores of websites were taken offline for maintenance last week as organizations raced to defend themselves — actions that may or may not have prevented successful compromises.

What this means for bug bounty hunters, enterprises, and security researchers

• Bug bounty hunters and pentesters: The CTF shows a public, time‑boxed challenge can reveal both the feasibility of an exploit and how public attention can degrade access to a target. Modhwadia said he did not attempt the challenge until it had "gained significant notice," and that earlier attempts might have failed before Pavur added the PHP endpoint.
• Enterprises and website owners: Even with mitigations such as request-size limits and ASLR, the event demonstrates that determined exploit development can bypass those protections; the Register documents widespread defensive downtime as organizations reacted to the threat.
• Security researchers and exploit developers: The episode confirms active work on PHP2Shell variants. Modhwadia’s single-file Python proof-of-concept and the cited commentary from exploit developers indicate multiple, evolving techniques are in circulation.

Modhwadia donated a portion of his payout to the Lupus Foundation to raise awareness of his own condition, a human detail that the Register included alongside the technical record. The episode leaves a clear imprint: a headline-grabbing CTF proved a complex exploit was practical in at least one targeted instance, exposed the fragility of public testing under load, and drew attention to ongoing exploit development — even as questions remain about how broadly and reliably such techniques can be applied in the wild.

Read the original Register report