Hacker cracks vulnerable PHP server in Bitcoin bounty challenge

Anonymous attacker claims over $2,000 in BTC after successfully exploiting critical PHP2Shell vulnerabilities in a live experiment

By LineZotpaper AI staff

Published26 October 2026

Read Time3 min

Follow this storyHear when it moves

Illustration: Hacker cracks vulnerable PHP server in Bitcoin bounty challenge

An anonymous hacker has breached a deliberately vulnerable server and claimed a Bitcoin prize worth $2,021.22, demonstrating that critical PHP vulnerabilities disclosed earlier this week can be reliably exploited in practice, according to the challenge's creator.

A hacker successfully compromised a server running unpatched PHP software and claimed a Bitcoin bounty of 0.02511679 BTC, worth $2,021.22 at the time, the creator of the 'Steal My Bitcoin' challenge confirmed on October 25. The experiment, hosted on a website and announced through a forum post a day earlier, initially offered approximately $502 worth of Bitcoin, but donations swelled the prize pot.

The challenge followed the disclosure of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can allow remote code execution under certain conditions. Fixes were released on October 21. The challenge's creator, posting under the name 'cloudlandsdev', said the project was designed to see whether anyone could use the vulnerabilities to compromise the server and claim its Bitcoin. "Made this because I'm curious if anyone out there has figured out how to actually use this PHP RCE, we spent the last few days panicking. Have fun!" the creator wrote.

The winning hacker, 'KillaBoi', published a proof of concept on GitHub describing the attack against the live challenge and providing a local test environment. The exploit took advantage of PHP's handling of multipart uploads and session data. By pushing a PHP worker beyond its memory limit, the attacker left internal state in an inconsistent condition. Subsequent requests exposed memory contents through session cookies, revealing the locations of PHP's memory structures and executable code. The attacker then used those addresses to construct a forged PHP data structure that triggered command execution during cleanup. The final request returned evidence that the command had run inside the PHP process.

Although the server was successfully compromised, the recovered private key did not match the advertised prize address. However, on-chain data showed the funds were subsequently sent to an address labeled as a Kraken cold wallet.

The experiment attracted rapid attention, but the traffic became a problem. In an update, the creator said visitors were exhausting the server's available computing resources shortly after each capacity increase. Limited storage also prevented the server from retaining all its logs, complicating efforts to document a successful attempt. The challenge ran for approximately 19.28 hours before the bounty was claimed.

The successful attack provides evidence that exploiting these PHP vulnerabilities may be achievable, as security teams face pressure to patch PHP installations following the public disclosure of PHP2Shell. A separate report on the vulnerability disclosure controversy detailed how premature publication disrupted the coordinated release process.

RSS

The Daily Edition

The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.

Analysis

Why This Matters

The successful exploit demonstrates that critical PHP vulnerabilities disclosed this week are practically exploitable, not merely theoretical.
Organizations running vulnerable PHP installations face urgent pressure to apply patches before attackers can weaponize the flaws at scale.
The experiment highlights the gap between vulnerability disclosure and real-world exploitation, something security teams must factor into their incident response timelines.

Background

The experiment involved two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, which received critical severity ratings and were patched on October 21. PHP2Shell refers to vulnerabilities in PHP's request-handling and memory-management processes that could allow remote code execution. The challenge's creator set up a live server to test whether attackers could chain the flaws into a working exploit. Previous Bitcoin recovery efforts have involved reverse-engineering password generators or using AI to locate backup files, rather than exploiting server vulnerabilities.

What to Watch

How quickly organizations patch PHP installations, especially public-facing web servers, in the wake of this demonstration.
Whether the proof of concept published by 'KillaBoi' leads to wider exploitation attempts against unpatched systems.
Any further details from the vulnerability disclosure controversy about how premature publication affected the patching process.

Sources

Bitcoin reward offered to anyone who could break into an unpatched server running PHP, hacker cracks site and claims bounty · Tom's Hardware

Checked

11 claims in this story checked against 1 source: 8 supported.

Show each claim

SupportedA hacker breached the vulnerable PHP server in the Bitcoin challenge.Latest from Tom's Hardware: “A hacker has successfully breached a vulnerable server, claiming a prize pot worth $2,021.22 in Bitcoin after exploiting PHP2Shell vulnerabilities”
Not in the sourcesThe attacker was anonymous.Latest from Tom's Hardware: “The winner, ‘KillaBoi’, published a proof of concept on GitHub describing the attack against the live challenge”
Partly supportedThe attack demonstrated that the vulnerabilities can be reliably exploited in practice, according to the challenge’s creator.Latest from Tom's Hardware: “That said, for now, evidence of the latest successful attack suggests that exploiting these PHP vulnerabilities may not be that hard after all.”
Not in the sourcesThe vulnerabilities were disclosed earlier that week.Latest from Tom's Hardware: “The experiment follows the disclosure of CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities that can allow remote code execution under certain conditions.”
SupportedThe prize was 0.02511679 BTC, worth $2,021.22 at the time of the win.Latest from Tom's Hardware: “Donations subsequently increased the pot to 0.02511679 BTC, worth $2,021.22 at the time of the win.”
SupportedThe creator confirmed the win on October 25.Latest from Tom's Hardware: “The challenge's creator confirmed the win on October 25”
SupportedThe creator wrote: “Made this because I'm curious if anyone out there has figured out how to actually use this PHP RCE, we spent the last few days panicking. Have fun!”Latest from Tom's Hardware: ““Made this because I'm curious if anyone out there has figured out how to actually use this PHP RCE, we spent the last few days panicking. Have fun!” the creator wrote.”
SupportedFixes for the two critical PHP vulnerabilities were released on October 21.Latest from Tom's Hardware: “The flaws received critical severity ratings, and fixes were released on October 21.”
SupportedThe winner, ‘KillaBoi’, published a GitHub proof of concept describing the attack on the live challenge and providing a local test environment.Latest from Tom's Hardware: “The winner, ‘KillaBoi’, published a proof of concept on GitHub describing the attack against the live challenge and providing a local test environment.”
SupportedThe recovered private key did not match the advertised prize address.Latest from Tom's Hardware: “Although the server was successfully compromised, the recovered private key did not match the advertised prize address.”
SupportedThe challenge ran for approximately 19.28 hours before the bounty was claimed.Latest from Tom's Hardware: “The creator's website recorded the successful claim at 15:47 UTC on October 25, after the challenge had been running for approximately 19.28 hours.”