Cybersecurity firm Trail of Bits has developed a production-grade PHP2Shell exploit that gains root access on servers running stock production configurations with address space layout randomization and multiple workers under load. CEO Dan Guido said the internal exploit works across ARM64 and x86-64 architectures on both Apache mod_php and nginx php-fpm deployments, compromising unmodified installations of WordPress, MediaWiki, phpBB and Laravel.
The demonstration counters skepticism fueled by a viral $2,000 Bitcoin bounty hosted on an intentionally unpatched server at stealmybitcoin.com, which went unclaimed for more than 17 hours despite repeated crashes. Security researcher s1r1u5 found that for the first 10 hours, the challenge server routed requests to a static HTML file through PHP’s single-threaded development server behind nginx, a setup that never initialized PHP or the vulnerable multipart parser.
After the operator exposed an actual PHP endpoint, s1r1u5 estimated the challenge could be solved in under five hours, though heavy traffic from the viral stunt has since overwhelmed the server and blocked requests. While no universal public proof of concept works across all PHP configurations, s1r1u5 noted that an attacker with access to frontier AI models such as GPT-5.6 Sol or OpenAI’s Daybreak can adapt a base exploit to a specific target in under 10 hours.
