the stealmybitcoin[.]com (php2shell) challenge is shit, and everyone already predisposed to dismissing ai's cyber capabilities is jumping on the bandwagon to call the bug unexploitable and overhyped. like bro, did you even try to solve it? i think the challenge can be solved in under five hours. whoever made stealmybitcoin just slopped it up like crazy, wasting an insane amount of people's time and tokens because of their sloppiness. just from a blackbox perspective, for the first ~10 hours, they seemed to be serving something like index.html through a wildly uncommon setup: nginx -> proxy_pass -> php -S -> index.html if you look at the PHP CLI server code, without a router, it doesn't even initialize php for static files, so you can't trigger the vulnerable multipart parser in the first place. after @LiveOverflow called this out, they updated the server to expose an actual PHP endpoint: stealmybitcoin.com/php-versi… this is still a crazy setup, running php's single-threaded development server behind nginx, but apparently the exploit works reliably now. except everyone who wanted to prove php2shell was fake made the challenge go viral, and the server basically got dosed by everyone else who want to solve. now you can barely even make a request to it.