{
  "id": 16622920,
  "title": "UK pentester 'killa' claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest",
  "url": "https://urgent.news/2026/10/26/uk-pentester-killa-claims-2k-bitcoin-prize-in-php2shell-capture-the",
  "topic": "finance",
  "section": "Finance & Markets",
  "published": "2026-10-26T16:14:00.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/10/26/uk-pentester-killa-claims-2k-bitcoin-prize-in-php2shell-capture-the-flag-contest/5305429"
  },
  "original_language": "en",
  "account": "A 26-year-old UK developer, known as \"Killa,\" has claimed a $2,000 Bitcoin prize for exploiting the PHP2Shell vulnerabilities that caused internet disruption. James Pavur launched the \"Steal My Bitcoin\" site on October 24 to prove the PHP2Shell exploit was not as simple as claimed, offering $2,000 in Bitcoin to anyone who could achieve Remote Code Execution (RCE) on his website. Modhwadia achieved RCE on the website in approximately three hours, exposing a PHP endpoint, despite the website's owner claiming it took 19.28 hours due to the site becoming unusable. After an error with a wallet key, Pavur awarded Modhwadia the Bitcoin prize, which was later increased to $2,000. Modhwadia published a write-up of his method, a Python script requiring 20 HTTP requests at most. Bug bounty hunters attempted the challenge, but the site became unusable due to its popularity. Alon Gal, co-founder and CTO at Hudson Rock, praised Modhwadia's work but emphasized it was a sophisticated, target-specific exploit, not indicative of an automated attack.",
  "summary": "Jaydip Modhwadia beats challenge designed to test real-world exploitability of PHP2Shell in around 3 hours",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Tom's Hardware",
        "title": "Bitcoin reward offered to anyone who could break into an unpatched server running PHP, hacker cracks site and claims bounty",
        "url": "https://urgent.news/2026/10/26/bitcoin-reward-offered-to-anyone-who-could-break-into-an-unpatched",
        "published": "2026-10-26T10:30:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}