Home / Articles / What the $2,000 bitcoin bounty actually proves / Versions / v1.1.0
What the $2,000 bitcoin bounty actually proves: what changed in v1.1.0
From v1.0.0 (2026-10-26, 77f353ae5) to v1.1.0 (2026-10-27, db67c5ce1), paragraph by paragraph.
0 paragraphs added, 0 removed, 3 changed in place, 53 unchanged. About 0 words added and 117 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
2 unchanged paragraphs
!shot dt-timeline.webp | images/ | The real timeline:timeline of the challenge launched at 08:21 UTC onfrom 21 October with no page that executed PHP at all, so the flaw could not be reached; the operator added one at 22:00 JST on 25 October; it was solved about three hours later, at 00:47 JST onto 26 October, notagainst the "19.28 hours" the site's own counter and most press reports gave. | chart
26 unchanged paragraphs, under In short {#in-short}, What actually happened {#bounty}, The real timeline is three hours, not nineteen {#timeline}…
!shot dt-waf.webp | images/ | CouldDetection acoverage firewallfor havephp2shell seen it coming?from Cloudflare, AWS WAF, Azure Front Door, Emerging Threats and Sophos each publish detection coverage for php2shell,Sophos, and each names its own gap: request-only inspection, header amplification under a size cap, a rule disabled by default, signatures a reshaped request can dodge, or no specific rule at all.gap. | chart
8 unchanged paragraphs, under Hardening without patching: what actually holds {#hardening}
!shot dt-harden.webp | images/ | Hardening without patching: session.upload_progress=0,four memory_limit=-1,measures blocking multipart requests at the edge, and a container or cgroup memory cap are each described bythat their own authors ascall partial.partial, and what GrapheneOS deployeddid and tested the first three, decided not to trust them, and took its only PHP service offline instead, patching and returning within about seven hours.instead. | chart
17 unchanged paragraphs, under What a defender would actually see {#logs}, What this does not claim {#limits}, Where this comes from {#sources}