# Source: StealMyBitcoin compromis en 19 heures grâce à l’exploit PHP2Shell

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Sixactualités: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# StealMyBitcoin compromis en 19 heures grâce à l’exploit PHP2Shell

**Sixactualités** · [https://sixactualites.fr/securite/stealmybitcoin-compromis-en-19-heures-grace-a-lexploit-php2shell/133717/](https://sixactualites.fr/securite/stealmybitcoin-compromis-en-19-heures-grace-a-lexploit-php2shell/133717/) · published 2026-10-26T09:30:18+00:00 · added by `curator@php.newsroom` · slug `sixactualites-securite-stealmybitcoin-compromis-en-19`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261027T094306Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Sixactualités (France, French), 26 October, by Alain Vernet: 'StealMyBitcoin compromised in 19 hours with the PHP2Shell exploit'. The piece is about a...

## What it says, as the collector read it

#### StealMyBitcoin compromis en 19 heures grâce à l’exploit PHP2Shell

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fr/news/sixactualites/securite-stealmybitcoin-compromis-en-19-heures-grace-a-lexpl`, snapshot `20261027T094306Z`. Copied byte for byte; every file's sha256 is in `captures/20261027T094306Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

Sixactualités (France, French), 26 October, by Alain Vernet: 'StealMyBitcoin compromised in 19 hours with the PHP2Shell exploit'. The piece is about a public hacking challenge, a site that invites researchers to attack it, and says the compromise reached the challenge environment and does not mean cryptocurrency wallets were stolen from users. It reports an exploitation lasting 19.28 hours against PHP 8.4.26, a prize of 2,000 dollars in bitcoin that is the challenge reward and not a loss figure, and a key that did not open the expected wallet; it stresses that a challenge result does not show every PHP installation is exposed. The rest is generic hardening advice (inventory PHP versions, patch to 8.4.27 or 8.5.12 after staging, check logs, limit the web service account, rotate exposed secrets). The text is short on sourcing and does not name who attacked the challenge. No exploit detail is recorded here.

> Le piratage informatique a permis d’atteindre l’environnement du défi, mais cela ne signifie pas que des portefeuilles de cryptomonnaies ont été dérobés dans une attaque contre des utilisateurs.

_Curator's translation:_ "The hack reached the challenge environment, but that does not mean that cryptocurrency wallets were stolen in an attack on users."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: "StealMyBitcoin compromis en 19 heures grâce à l’exploit PHP2Shell". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.

#### Capture notes

Language `fr-FR`. A thinly sourced local-news rewrite with a first-person columnist voice; the page text names no primary. Nothing in the article text addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261027T094306Z · HTTP 200 · https://sixactualites.fr/securite/stealmybitcoin-compromis-en-19-heures-grace-a-lexploit-php2shell/133717/- `headers.json` 6db4b38db9064404eedc5f8108fcca35a3b93167c54513a8657d41b56fe75957 548 bytes
- `page.html` 15a0e5a5ae16136805d7cf0f60dfd336916823fb36a029c24cac6d5ac49ef17b 298,673 bytes
- `provenance.json` 9f94b605bb5a7609549d756d86047e596403ea4470be46dadefcc2d797c9c0c7 1,809 bytes
- `rendered.html` 880c5b397c47fcfa48b42c94226b37c8ca79c43cc5388724972ae14f153f822c 1,019,197 bytes
- `screenshot.jpg` 678dc6e7b43c5bd22cf8933efd1c4674f13b9631b591ebe240a911c74894aa25 776,821 bytes
- `text.txt` 8a89327d12881a0914d3a1da379d203cfe3b4a41421badb2896813e8941e4cd5 10,479 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.45 · data as of 2026-10-27T09:43Z · vault commit 55b47c4d6af1 · https://refs.php.oct.2026.newsroom.sgit.ai/sources/sixactualites-securite-stealmybitcoin-compromis-en-19/index.html