GoKawiilSecurity researcher publishes Python PoC for PHP memory-exhaustion exploit chain
A developer released stealmybitcoin_poc.py, a standard-library Python script that reproduces the request sequence used to solve the 'Steal My Bitcoin' CTF challenge against PHP 8.4.26. The exploit abuses memory exhaustion during multipart session upload-progress parsing to leak heap and code addresses, then forges a HashTable to trigger a system() call via fewer than 20 HTTP requests. The author notes the script targets a local Docker lab replicating the challenge's Alpine/nginx/PHP-FPM setup rather than the live competition target.