Bitcoin Challenge Tests Whether PHP Flaws Can Expose a Hidden Key

A public security challenge is testing whether users can use two recently patched PHP flaws to retrieve a hidden key from a server running an older version of the software. The test centers on PHP2Shell, a pair of vulnerabilities that can allow remote code execution under certain conditions. Steal My Bitcoin gives the PHP user access to a print-flag binary that reveals the key. Its maker, posting as cloudlandsdev, said the challenge was created to see whether anyone could use the newly disclosed flaws in practice.