I was so wrong about this (and the rest of my life).
There is indeed a leak in php2shell, and hype didn't fade this weekend.
Stealmybitcoin has its bitcoin stoled, and writeup is really impressive. I like this.
https://github.com/KillaBoi/StealMyBitcoin-PoC