{
  "id": 16623712,
  "title": "UK pentester 'killa' claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest",
  "url": "https://urgent.news/2026/10/26/uk-pentester-killa-claims-2k-bitcoin-prize-in-php2shell-capture-the-16623712",
  "topic": "finance",
  "section": "Finance & Markets",
  "published": "2026-10-26T16:14:00.000Z",
  "source": {
    "name": "The Register",
    "slug": "the-register",
    "url": "https://www.theregister.com/security/2026/10/26/uk-pentester-killa-claims-2k-bitcoin-prize-in-php2shell-capture-the-flag-contest/5305429"
  },
  "original_language": "en",
  "account": "A 26-year-old UK developer, identified as Jaydip Modhwadia or \"Killa,\" has been awarded a $2,000 Bitcoin prize for successfully exploiting the PHP2Shell vulnerabilities in a recent Capture The Flag (CTF) contest. The challenge, initiated by James Pavur on October 24 through the site \"Steal My Bitcoin,\" aimed to demonstrate that the PHP2Shell exploit was not as straightforward as initially believed. Modhwadia achieved the required Remote Code Execution (RCE) on the website in just three hours after the contest began, despite initial skepticism from the cybersecurity community regarding the exploit's feasibility. The website's owner, Pavur, later increased the prize to $2,000 after an error with the Bitcoin wallet key. Modhwadia provided a write-up detailing his approach, which involved a single Python script with a maximum of 20 HTTP requests. Despite the site becoming unusable due to high traffic, Modhwadia's success highlights the exploitability of PHP2Shell, even with technical constraints in place. Experts have praised Modhwadia's work, noting that while it demonstrates the exploit's potential, it does not imply that the attack can be automated at scale.",
  "summary": "Jaydip Modhwadia beats challenge designed to test real-world exploitability of PHP2Shell in around 3 hours",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Tom's Hardware",
        "title": "Bitcoin reward offered to anyone who could break into an unpatched server running PHP, hacker cracks site and claims bounty",
        "url": "https://urgent.news/2026/10/26/bitcoin-reward-offered-to-anyone-who-could-break-into-an-unpatched",
        "published": "2026-10-26T10:30:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}