{
  "id": 16589379,
  "title": "Bitcoin reward offered to anyone who could break into an unpatched server running PHP, hacker cracks site and claims bounty",
  "url": "https://urgent.news/2026/10/26/bitcoin-reward-offered-to-anyone-who-could-break-into-an-unpatched",
  "topic": "finance",
  "section": "Finance & Markets",
  "published": "2026-10-26T10:30:00.000Z",
  "source": {
    "name": "Tom's Hardware",
    "slug": "tom-s-hardware",
    "url": "https://www.tomshardware.com/tech-industry/cryptomining/hacker-offers-bitcoin-reward-to-anyone-who-can-break-into-an-unpatched-server-running-php-still-remains-unhacked-php2shell-challenge-tests-claims-that-ai-makes-exploiting-vulnerabilities-easy"
  },
  "original_language": "en",
  "account": "A hacker breached an unpatched server running PHP and successfully claimed a Bitcoin bounty of $2,021.22, according to a posting on the Steal My Bitcoin website. The creator of the challenge confirmed the win on October 25, ending an experiment designed to test the ease of exploiting critical software vulnerabilities. The challenge began with a Bitcoin prize of approximately $502, which increased to 0.02511679 BTC, or $2,021.22, after receiving donations. The experiment followed the disclosure of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which could allow remote code execution. The creator, known as 'cloudlandsdev,' hoped to determine if anyone could exploit these vulnerabilities to compromise the server and claim the Bitcoin. The attacker, identified as 'KillaBoi,' logged successful claim at 15:47 UTC on October 25, after 19.28 hours. After the exploit, the private key did not match the advertised prize address, but the funds were later sent to a Kraken cold wallet. This successful attack suggests that exploiting PHP vulnerabilities may not be as difficult as previously thought.",
  "summary": "The “Steal My Bitcoin” challenge offers a bounty to anyone who can breach a deliberately vulnerable PHP website using the recently disclosed PHP2Shell flaws. The challenge follows previous recoveries of locked Bitcoin fortunes through software vulnerabilities and AI-assisted investigation, but no successful claim has been confirmed.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Register Science",
        "title": "UK pentester 'killa' claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest",
        "url": "https://urgent.news/2026/10/26/uk-pentester-killa-claims-2k-bitcoin-prize-in-php2shell-capture-the",
        "published": "2026-10-26T16:14:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}