TL;DR for the first 26 hours the page was a static html page being served by php. After the challenger author was informed that if there is no php code php doesn't execute, the author added a phpversion() script.

After this became exploitable it took 2 hours for someone to hack the server and steal the bitcoin.