Observations from Running Steal My Bitcoin
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
James Pavur ran "Steal My Bitcoin," a public challenge with a $500 bitcoin wallet on a cheap PHP server, to test whether the PHP2Shell vulnerability works outside a lab. By his account, one participant exploited it over the open internet. Of tens of thousands of attempts, only two triggered the flag binary, and only one extracted data. He concludes that PHP2Shell is real and should be patched, but that unskilled attackers with LLMs are not there yet. The figures are self-reported from one server, with partial logging.