A $500 bitcoin wallet sat on a PHP server for hours and nobody took it

The rules of the game

Steal My Bitcoin was the entire pitch, quoted in the thread by a commenter after the server buckled: a bitcoin key worth about $502, "accessible to the PHP user account through the print-flag binary." The PHP version was chosen from before the PHP2SHELL CVEs were released, the first person to get the wallet wins, and all traffic is logged. The site's counter ticked up the hours without a successful hack.

The author's bet is a price signal. If automated exploitation of the new PHP bugs were as cheap as the headlines claim, a $500 target would vanish in minutes.

Why nobody walked off with it

"It's more like they're offering $500 to be taught how to utilise the exploit." — anonymous908213

One commenter with an LLM-built proof of concept reported it could crash the site but not reach remote code execution: that would still need a working exploit chain and an ASLR bypass, and the server runs Nginx with PHP-FPM, not the easier Apache mod_php setup. Another read the configuration more pessimistically for attackers: CLI server, 1 MiB cap, inert page and high memory limit remove the paths the two CVEs need, so the target may not be vulnerable at all.

A third camp suspected a trap.

"OP gets their working exploit neatly logged (or even multiple approaches), keeps the money, strengthens the illusion the exploit isn't that bad" — orlp

The prize becomes the story

By the time the thread passed 250 comments, other readers had added money: a commenter noticed $1,004, then $2k. A commenter who had used the earlier panic said the arithmetic had flipped.

"80h ago everyone was advising everyone else to take all their websites immediately down. Now it's only worth it to hack a website that's asking to be hacked if the prize is $15k." — ncruces

For anyone running PHP, the useful reading is narrower than either camp wants: the bugs are real, but turning a patch diff into a shell on a specific stack still takes expertise that $500 does not buy, and the growing pot is now measuring where that price sits.