StealMyBitcoin (php2shell CTF) solution writeup github.com

KillaBoi’s writeup presents a standard-library Python proof of concept for the Steal My Bitcoin PHP CTF: memory-exhaustion requests leak heap and code addresses, which are used to forge a PHP cleanup callback that runs a command. The author reports reproducing the chain in a local PHP 8.4.26 Alpine lab and says a 2026 live run returned a checksum-valid private key, while noting the original network traffic was not captured and the key did not match the advertised prize address.