UK pentester 'Killa' achieves RCE via PHP2Shell in CTF, winning $2,000 Bitcoin prize and bypassing ASLR
UK-based pentester Jaydip Modhwadia ("Killa") won a $2,000 Bitcoin prize in the "Steal My Bitcoin" CTF set up by James Pavur on October 24. He demonstrated working remote code execution (RCE) through the PHP2Shell vulnerabilities. The challenge was meant to test claims that PHP2Shell is easy to exploit. Modhwadia reports roughly three hours of actual work, although the site's banner shows 19.28 hours because the site became unusable under heavy traffic. His solution is a single-file Python script needing at most 20 HTTP requests, and it reportedly bypasses ASLR, which early analysis had suggested would be a significant barrier. Hudson Rock's Alon Gal cautioned that this was a sophisticated, target-specific exploit and does not mean arbitrary PHP servers can be compromised at scale.
Entenda a falha
A vulnerabilidade
PHP2Shell is a set of vulnerabilities in PHP that allow remote code execution (RCE) on a server. The articles give no CVE IDs, affected or fixed versions, or component names. In the CTF, the target ran a vulnerable PHP version and had to serve a PHP file that the exploit could use as a hook. Static HTML alone gave no exploit path. With that in place, a remote attacker achieved RCE over HTTP. The articles do not say whether authentication is required.
Como funciona
The articles describe the mechanism only at a high level. The attacker sends HTTP requests to a site that serves a PHP file, and the vulnerable PHP version handles them in a way that ends in code execution. The winning exploit needed at most 20 requests and, according to the articles, got around ASLR, which early analysis expected to be a major barrier. A 1MB request-size limit on Nginx did not stop the attempts. The articles do not explain the internal steps where the processing goes wrong.
Por que é vulnerável
The articles do not state the root cause of PHP2Shell, such as which check is missing or which memory error occurs. They only show that the flaws allow RCE and that the ASLR protection can be bypassed. They also give no information on why the flaws went unnoticed or on what the fix changes. The story says there is no specific patch guidance.
Como foi descoberta
The articles do not say who found the flaws or how. They say exploit code was seen online hours or even days before public disclosure, which led to millions of exploit attempts, though their effectiveness on real systems was still unclear. VulnCheck's Spencer McIntyre said attackers keep finding new ways to exploit it. The CTF itself came from James Pavur, who wanted to test claims that PHP2Shell is easy to exploit. Jaydip Modhwadia (Killa) won it on October 25.
PoC pública
Pentester Jaydip Modhwadia published a write-up of his method, including a single-file Python script that he says needs at most 20 HTTP requests. It achieved working RCE against the CTF site once a PHP endpoint was exposed, and it reportedly bypasses ASLR. The Register says it is not the first PoC but is a more advanced one. Hudson Rock's Alon Gal stressed it was a sophisticated, target-specific exploit and does not mean arbitrary PHP servers can be compromised at scale. It still shows PHP2Shell can be weaponized against a live target, so patching is urgent. The articles give no address for the write-up.
Explicação gerada por IA a partir da matéria e dos artigos, em 26/10/2026 14:16.
Detalhes técnicos
- The target ran a vulnerable PHP version but initially served only static HTML, so the exploit path was unavailable. Pavur reportedly added a PHP endpoint around 1300 UTC on October 25, and Modhwadia achieved RCE at 1547 UTC.
- The exploit path requires the vulnerable site to serve a PHP file that can be used as a hook.
- Pavur applied a 1MB request limit on Nginx, which did not stop the large volume of attempts.
- VulnCheck's Spencer McIntyre said attackers are actively finding new ways to exploit PHP2Shell.
- Experts previously reported exploit code circulating hours or days before public disclosure, producing millions of exploit attempts, with real-world efficacy still unclear. Many websites were taken down for maintenance the previous week.
Remediação
The article gives no specific patch guidance. It notes that organizations took sites offline for maintenance while racing to protect themselves.
Linha do tempo
-
UK pentester 'Killa' achieves RCE via PHP2Shell in CTF, winning $2,000 Bitcoin prize and bypassing ASLR
ler a análise desta fonte ocultar
UK-based pentester Jaydip Modhwadia ("Killa") won a $2,000 Bitcoin prize in the "Steal My Bitcoin" CTF set up by James Pavur on October 24. He demonstrated working remote code execution (RCE) through the PHP2Shell vulnerabilities. The challenge was meant to test claims that PHP2Shell is easy to exploit. Modhwadia reports roughly three hours of actual work, although the site's banner shows 19.28 hours because the site became unusable under heavy traffic. His solution is a single-file Python script needing at most 20 HTTP requests, and it reportedly bypasses ASLR, which early analysis had suggested would be a significant barrier. Hudson Rock's Alon Gal cautioned that this was a sophisticated, target-specific exploit and does not mean arbitrary PHP servers can be compromised at scale.
Technical Details
- The target ran a vulnerable PHP version but initially served only static HTML, so the exploit path was unavailable. Pavur reportedly added a PHP endpoint around 1300 UTC on October 25, and Modhwadia achieved RCE at 1547 UTC.
- The exploit path requires the vulnerable site to serve a PHP file that can be used as a hook.
- Pavur applied a 1MB request limit on Nginx, which did not stop the large volume of attempts.
- VulnCheck's Spencer McIntyre said attackers are actively finding new ways to exploit PHP2Shell.
- Experts previously reported exploit code circulating hours or days before public disclosure, producing millions of exploit attempts, with real-world efficacy still unclear. Many websites were taken down for maintenance the previous week.
Remediation
The article gives no specific patch guidance. It notes that organizations took sites offline for maintenance while racing to protect themselves.