# Hacker demonstrates PHP2Shell attack against public challenge server

_Published Monday, October 26, 2026 at 10:07 AM EDT · Security · Latest · Tier 2 — Notable_

![Bitcoin price — Primary](https://cdn.mos.cms.futurecdn.net/nR46h5GnedCeKyZtVqZr3L-1920-80.jpg)

A hacker breached a deliberately vulnerable PHP server in a public challenge, whose creator confirmed the win on October 25, Tom's Hardware reported. The winner published a proof of concept and a local test environment on GitHub.

The attack manipulated multipart uploads and session data, pushed a PHP worker beyond its memory limit, and used exposed memory addresses to trigger command execution. Fixes for the two critical PHP2Shell vulnerabilities were released on October 21. The recovered private key did not match the advertised prize address, although the creator confirmed the challenge had been won.

## Sources

- [Tom's Hardware](https://www.tomshardware.com/tech-industry/cryptomining/hacker-offers-bitcoin-reward-to-anyone-who-can-break-into-an-unpatched-server-running-php-still-remains-unhacked-php2shell-challenge-tests-claims-that-ai-makes-exploiting-vulnerabilities-easy)

---
Canonical: https://techandbusiness.org/newswire/m93C8vLmFo_NwMbkiA4d89
Published: 2026-10-26T14:07:25.170Z
Story chronology: 2026-10-25T15:47:00.000Z
Retrieved: 2026-10-26T16:59:27.536Z
Publisher: Tech & Business (techandbusiness.org)