People will start elaborate hoaxes with no financial or political motive. It doesn't have to have a race or gender or AI angle. For most of these hoaxes, I suspect that you are unlikely to find a kind soul you'll find on the internet debunking it; it just goes uncovered forever. So if you regularly read Twitter and intentionally or unintentionally incorporate anecdotes and online experiments you see into your worldview, you are probably doing a disservice to yourself and humanity.
I don't see any evidence that this was created as a hoax. The PHP server was set up by running a local development server from the CLI and exposing an nginx server that proxied requests to the local PHP dev server. This is not a common setup at all! Indeed, the docs explicitly warn against running a dev server in a production setting, as it differs in behaviour.
The nginx → PHP dev server setup is, however, a path of least resistance if you're versed in Linux, systemd, and nginx, but not PHP itself. Given the challenge authors' background in technical cyber... (read more)
Some guy put up a site (https://stealmybitcoin.com/) with the vulnerable version of PHP running, and a bitcoin address with money on it. He posted it to hackernews.com and invited people to attempt to exploit it, and it became highly upvoted. The wallet has not been drained in 24 hours; an enormous number of people then cited this random internet stranger's "experiment" as evidence that the vulnerability is overhyped. However, not only did the stealmybitcoin guy configure Apache in an unusual way designed to make the exploit impossible, he hadn't even put any PHP pages on the website. I would not be surprised if there is no wallet on the website and this is just an attempt to farm exploits.
2papetoast
I was aware of the story but I was confused because the way you linked the twitter thread made me think the exposer is the one starting a hoax. It also doesn't seem intentional/malicious enough that I would call this a hoax