Notably, the attacker used those addresses to construct a forged PHP data structure that triggered command execution during cleanup. The final request returned evidence that the command had run inside the PHP process. Although the server was successfully compromised, the recovered private key did not match the advertised prize address. However, on-chain data shows the funds were subsequently sent to an address “bc1qr4…lk7a9” , labeled as a Kraken cold wallet.
Bitcoin recovery efforts have previously involved reverse-engineering software rather than exploiting a live server. In 2024, hardware hacker Joe Grand, known as ‘Kingpin”, and researcher Bruno recovered access to 43.6 BTC belonging to an owner identified as Michael, who had forgotten a 20-character wallet password.
The researchers reverse-engineered an older version of RoboForm's password generator and identified a flaw that made the password predictable. They recovered the wallet in November 2023, when the Bitcoin was worth approximately $1.6 million. Its value had climbed to nearly $3 million by the time the recovery was reported in May 2024.
A more recent case involved a Bitcoin holder who r ecovered five BTC worth roughly $400,000 in May 2026 after losing access to the wallet for years. The pseudonymous owner, known as ‘cprkrn’, said Anthropic's Claude AI helped identify a backup file from December 2019, which could be decrypted using a password the owner had previously written down in a notebook. The backup contained the keys needed to access the Bitcoin.
The latest event comes as security teams face pressure to patch PHP installations following the public disclosure of PHP2Shell. A separate report on the vulnerability disclosure controversy detailed how premature publication disrupted the coordinated release process. That said, for now, evidence of the latest successful attack suggests that exploiting these PHP vulnerabilities may not be that hard after all.
Newton Gitonga Freelance Writer Newton Gitonga is a tech journalist covering gadgets, PC hardware, AI, data centers, and the wider tech industry. His interest in technology started early, taking apart things around the house to see how they worked, often to his dad’s frustration. His curiosity sometimes got the better of him, including a few failed attempts to fix laptops, one of them a gifted Dell XPS. He has previously written for Notebookcheck, ZyCrypto, CoinCentral, and Crypto News Flash.
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/tech-industry/cryptomining/SPONSORED_LINK_URL
- https://www.tomshardware.com/tech-industry/cryptomining/hacker-offers-bitcoin-reward-to-anyone-who-can-break-into-an-unpatched-server-running-php-still-remains-unhacked-php2shell-challenge-tests-claims-that-ai-makes-exploiting-vulnerabilities-easy#main
- https://www.tomshardware.com/membership
- Save $134 on this WD Red Plus 10TB HDD bundle at Newegg
- NVIDIA Transforms European Retail, From Digital Discovery to Physical Operations
- Anthropic prepares for potential $2 trillion IPO valuation after reporting billions in revenue
- NVIDIA Cosmos Opens New Tools to Train, Evaluate and Deploy World Models
- 3.2 Petabits per second real-time optical fiber transfer speed world record claimed by Chinese team
Informational only. No financial advice. Do your own research.