Researcher Claims Roughly $2,000 Bitcoin Bounty After Breaching Vulnerable PHP Server

Security researcher Killa has claimed an approximately $2,000 Bitcoin prize after successfully exploiting critical PHP vulnerabilities on the "Steal My Bitcoin" challenge website. Launched on October 24 by operator cloudlandsdev (James Pavur), the contest evaluated the real-world impact of the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619. The prize pot, which held up to 0.02511679 BTC, remained safe initially because the unpatched PHP 8.4.26 server served static HTML. Once PHP endpoints were updated on October 25, the researcher executed remote code at 15:47 UTC, verified the exploit, and subsequently published a proof-of-concept.