bibibi.ccLoading…
Connect scattered updates into a story you can understand.
A researcher allegedly exploited a PHP vulnerability to crack the “Steal My Bitcoin” challenge and receive a 0.02511679 BTC prize. After discovering that the wallet key retained on the server was incorrect, the operator instead transferred the prize manually.
BlockBeats stated that researcher killa exploited the PHP2Shell vulnerability to breach a bounty website deliberately using an unpatched PHP version, obtained the server's private key, and claimed the 0.02511679 BTC reward.
The SlowMist security team said the two PHP high-severity vulnerabilities may affect Web3 off-chain services running affected versions. The official releases include multiple fixes. The report recommends that relevant projects upgrade as soon as possible to prevent servers from being compromised, followed by front-end tampering and induced malicious signing.
Dimitri Vedeneev, head of the security artificial intelligence business at CyberCX, said that the recent exposure of the PHP vulnerability shows AI that weaknesses in widely used technologies can be discovered more quickly, and organizations should shorten their response preparedness from several weeks to several hours.
PANews reported that the South Korean presidential office said the National Security Office held an emergency cybersecurity meeting on PHP the vulnerability.
PANews Daily roundup says that the Swell administrator key is suspected to have been leaked, and malicious contract upgrades may threaten approximately 2500 ETH; this claim has yet to be officially confirmed.
According to PANews,CZ warned users on X to exercise caution when visiting websites over the next few days, stating that details of PHP vulnerabilities were leaked before patches were released and that exploitation cases have reportedly already occurred.
