As far as I know, there has been no proven vulnerability on a modern PHP (production) stack. The "Steal my Bitcoin" challenge was a toy project. The "lab" target used the embedded PHP server (`php -S`) which is for development only.

> Warning. This web server is designed to aid application development. [...] It should not be used on a public network. https://www.php.net/manual/en/features.commandline.webserver...

There are 3 main PHP interfaces (SAPI):

1. mod_php which is obsolete and requires Apache prefork (which should also be avoided)

2. php-fpm (FastCGI) which has been the default for more than a decade.

3. FrankenPHP is a new official interface much more suitable for containers.

There were 2 vulnerabilities.:

1. "OOM corruption". The advisory says there was a proven exploit with mod_php, but only for that obsolete SAPI. "Source analysis therefore supports FPM as a susceptible, though *no complete FPM exploit* has been demonstrated for this SAPI."

2. "stale global state". The advisory is The last PHP release (8.5) was vulnerable when the debug parameter fatal_error_backtraces was on. There was a suspicion that an exploit could exist in the session code for php-fpm, but it was unproven and probably unrealistic.

The "evidence" given at the end of the article seems old news to me. The honeypot was based on Apache-prefork + mod_php. As stated in the CVE, there is a proven exploit for that (obsolete) stack.