Observations from Running stealmybitcoin
Last week, I saw an article on the front page of the New York Times website reporting that a critical vulnerability in PHP had been found. The article, and others like it, claimed any attacker could achieve arbitrary remote code execution on any of the millions of running PHP services worldwide simply by sending a few unauthenticated web requests that exploited the PHP2Shell vulnerability.
Quick read
A first-person account of an experiment that deployed a vulnerable PHP site (stealmybitcoin.com) to test whether the PHP2Shell vulnerability was exploitable in the wild and whether low-skill attackers using AI could exploit it. The author describes hosting setup, traffic and logging details, exploit results, and what happened during the viral Hacker News traffic spike.
- Hosted a deliberately vulnerable PHP site with a small bitcoin reward
- Observed heavy real-world attack traffic and resource exhaustion
- Confirmed at least one remote exploit succeeded, but few extracts worked
Reactions
No reactions yet. Record a short about this link and it shows up here, in Reels and in the community feed.
Is pavursec.com your site? Sign in to verify it and get a Verified badge, full stats and a link-back badge.
Observations from Running stealmybitcoin was shared on NexURLs by Nexis on November 4, 2026, in Tech & AI.
What we found on this site
- Built with
- Hugo
- Served through
- Cloudflare
- Home page answered in
- 173 ms
- Trackers
- None found
- Ads
- None found
- RSS feed
- No
- AI crawlers
- Lets them in
- Set up for phones
- Yes
- Real-visitor speed
- Not enough visitors for Google data
- Popularity
- Top 200,000 domain (Cloudflare)
- Google safety check
- No threats found
- Domain registered
- 2017
- Domain renews
- July 2030
Checked November 4, 2026 from the site’s own code and public records. See how the rest of the web compares in the NexURLs Internet Report.
Quick answers
What is Observations from Running stealmybitcoin?
Observations from Running stealmybitcoin (pavursec.com): A first-person account of an experiment that deployed a vulnerable PHP site (stealmybitcoin.com) to test whether the PHP2Shell vulnerability was exploitable in the wild and whether low-skill attackers using AI could exploit it. The author describes hosting setup, traffic and logging details...
Who shared Observations from Running stealmybitcoin on NexURLs?
It was shared by Nexis in November 2026. Every link on NexURLs is shared by a real member and passes a safety check before it goes out.
What are some sites like Observations from Running stealmybitcoin?
Members found these close to it: Upcoming PHP security release, php2shell-poc, Upcoming Critical PHP Security Release. The full list is on this page under Sites like Observations from Running stealmybitcoin.
Sites like Observations from Running stealmybitcoin
- Upcoming PHP security release (CVE-2026-109618 / -109619)news-web.php.net
- php2shell-poc: CVE-2026-109618/109619 - 5 RCE chains + detection rules (Suricata, Sigma, Mgithub.com
A GitHub repository documenting five PHP pre-auth remote code execution chains (CVE-2026-109618 and CVE-2026-109619)...
- Upcoming Critical PHP Security Releasephp.net
- Remote Code Execution Vulnerability in Googlesimonkoeck.com
This site details a remote code execution vulnerability found in Google’s Flask session cookies. It provides insights...
- Hacker Newsnews.ycombinator.com
- TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8atlasum.net
A technical writeup of CVE-2026-98432, a remote use-after-free in Linux's IPv4 TCP handshake rated CVSS 9.8 and fixed...
More Tech & AI finds
- Epic's EAC2 v2 seems fairly easily bypassablecodon.org.uk
- My obituary for programmingdumbmatter.com
- Scalable Vector Griefportswigger.net
- Lobsterslobste.rs
- Le Chat by Mistralchat.mistral.ai
- Poepoe.com
Feeling lucky? Try the random website generator.
Where people went next
Nobody has added a next stop yet. Be the first.