randomblock1

  for (size_t i = count; i > 0; --i) {
      // use array[i - 1]
  }

  size_t index = i - 1;

https://cursor.com/blog/typescript-sdk

> (AI) "A static handler (nginx’s static path, or php_cli_server_begin_send_static) just sends bytes; it never enters the PHP request lifecycle, so php_request_startup() never runs and the Zend executor/session/multipart parser the chain needs is never initialized."

The author is trying to prove their point that PHP2Shell is hard to exploit. But it's unrealistic because PHP servers usually run PHP code at some point.

I had an LLM recreate this Tweet and yes, it can make an exploit without reward hacking. It took 5 minutes. https://x.com/dguido/status/2113129153293897925

so basically the OP is doing a little trolling

> https://stealmybitcoin.com/ This is a CTF for the new PHP vulnerability. Try to find what php version it runs.

(eventually figures it out)

> OK, now get the flag

I'll go for RCE, carefully — the author explicitly invites this, and I'll keep probes minimal.

  $ curl -sS -D - -o /dev/null -X FOO https://stealmybitcoin.com/
  HTTP/1.1 501 Not Implemented
  Server: nginx
  Date: Sat, 24 Oct 2026 22:06:58 GMT
  Content-Type: text/html; charset=UTF-8
  Content-Length: 495
  Connection: keep-alive
  Host: stealmybitcoin.com
  X-Powered-By: PHP/8.4.26

Also, the only pages I found are static and not an actual PHP entry point. If it doesn't run any PHP, it's not vulnerable to PHP2Shell. At least I think that's how it works.

https://github.com/search?q=caffeinate+lid+close&type=reposi...

So... potentially? The improvements in other areas might help coding, but aren't that big either, except on their own benchmark.