A new website is putting the internet’s biggest cybersecurity scare of the year to a very public, very literal test.
Stealmybitcoin.com is exactly what it sounds like. The site runs a PHP version picked specifically from before the PHP2Shell CVEs were patched, and hides a Bitcoin key worth roughly $500, accessible to the PHP user account through a binary called print-flag. The rules are clear: first person to get the wallet, wins. A running counter on the homepage ticks up the hours since the challenge went live without a successful hack, serving as a live, public scoreboard for whether PHP’s “most severe vulnerability in decades” is as easy to weaponize in the wild as the headlines suggested.
It’s a cheeky, almost trollish experiment. As of writing, it’s been 20 hours and the bitcoin hasn’t been stolen. But it’s sitting on top of a genuinely significant security story.
What PHP2Shell Actually Is
Earlier this month, the PHP Foundation shipped emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively nicknamed PHP2Shell. Both carry a CVSS v4.0 severity score of 9.2 out of 10, and both can, under the right conditions, let an unauthenticated attacker run code on a server with nothing more than a web request. One flaw stems from how PHP handles out-of-memory conditions during a request; the other is a classic use-after-free bug, where internal state from one request lingers in memory long enough for a later request on the same worker to exploit it.
Because PHP quietly powers something like 70% of the server-side web, including WordPress, Drupal, Joomla and Magento installs, the blast radius was framed as enormous. Government websites in multiple countries went dark as agencies in the UK, Australia, Japan and France urged organizations to patch immediately or pull systems offline entirely. Cloudflare says it had WAF rules in place roughly nine hours before the vulnerabilities were even publicly disclosed, which tells you how seriously the big infrastructure players were taking it.
What made PHP2Shell stand out from a typical CVE cycle, though, wasn’t just the severity, it was who found it. The bugs were unearthed by security researchers at Calif and at Wiz, both leaning on frontier AI models to do work that, by their own account, was previously too complex to pull off reliably by hand. OpenAI’s GPT-5.6 Sol model played a direct role in surfacing the flaw, with Wiz crediting Google’s Gemini 4 Argon for an “invaluable contribution” on the exploit-development side. Wiz went as far as calling it one of the most severe vulnerabilities ever found in software, arguably on par with Heartbleed.
That AI angle is why PHP2Shell became more than a patch-your-servers story. It became a referendum on whether AI-assisted vulnerability research had just crossed into territory that used to require elite human talent and months of effort, compressed into days.
Where The Overhype Argument Comes In
The reaction since disclosure has run from measured to apocalyptic. Shopify’s CEO called it the craziest day in cybersecurity in a long time, and Salesforce’s Marc Benioff treated it as a code-red moment, comments that came amid what’s now being referred to in the industry as a “Black October” of back-to-back security incidents, PHP2Shell being just one entry on a crowded list that also included a critical Brotli decoder flaw that forced Node.js into emergency patches of its own.
Skeptics, meanwhile, point out that security researchers have been burned before by AI-flagged vulnerabilities that turned out to be minor or outright false alarms, and that “critical” on paper doesn’t always translate to “trivially exploitable” in practice. Actually weaponizing PHP2Shell reportedly still requires a fairly intricate chain of steps, which is partly why it sat undiscovered in the PHP codebase for over a decade despite extensive prior audits. The theoretical severity is real. Whether it translates into the kind of mass, automated pwning that the framing implies is a separate question entirely.
That’s effectively the question stealmybitcoin.com is trying to answer empirically rather than rhetorically. Instead of arguing about exploit complexity in the abstract, it puts a known-vulnerable PHP instance on the open internet, with real money attached, and lets anyone with an opinion go prove it. All traffic on the site is logged and visible to other attackers, so there’s no expectation of privacy for anyone who takes a shot. As of writing, the counter is still running, meaning no one has walked away with the $500 yet.
Whether that holds up or someone cracks it in the next news cycle is, fittingly, the entire point. Either result tells you something real about how far the gap between “critical CVE” and “practically exploitable at scale” has actually narrowed.