Bitcoin reward offered to anyone who could break into an unpatched server running PHP, hacker cracks site and claims bounty
The “Steal My Bitcoin” challenge offers a bounty to anyone who can breach a deliberately vulnerable PHP website using the recently disclosed PHP2Shell flaws. The challenge follows previous recoveries of locked Bitcoin fortunes through software vulnerabilities and AI-assisted investigation, but no successful claim has been confirmed.
A hacker breached an unpatched server running PHP and successfully claimed a Bitcoin bounty of $2,021.22, according to a posting on the Steal My Bitcoin website. The creator of the challenge confirmed the win on October 25, ending an experiment designed to test the ease of exploiting critical software vulnerabilities. The challenge began with a Bitcoin prize of approximately $502, which increased to 0.02511679 BTC, or $2,021.22, after receiving donations.
The experiment followed the disclosure of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which could allow remote code execution. The creator, known as 'cloudlandsdev,' hoped to determine if anyone could exploit these vulnerabilities to compromise the server and claim the Bitcoin. The attacker, identified as 'KillaBoi,' logged successful claim at 15:47 UTC on October 25, after 19.28 hours.
After the exploit, the private key did not match the advertised prize address, but the funds were later sent to a Kraken cold wallet. This successful attack suggests that exploiting PHP vulnerabilities may not be as difficult as previously thought.
Written by urgent.news from Tom's Hardware's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
