A security researcher known as @killa has claimed a Bitcoin reward worth approximately $2,000 after exploiting two critical vulnerabilities in PHP during a challenge hosted on stealmybitcoin.com. The researcher completed the challenge on October 25, 2026, after 19.28 hours of testing and exploitation attempts.
The challenge invited security researchers to retrieve a hidden Bitcoin wallet key from a deliberately vulnerable PHP environment. The prize, initially worth several hundred dollars, grew to approximately $2,000 as additional donations were added to the wallet.
The challenge was designed to demonstrate the practical impact of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Both flaws can potentially allow unauthenticated attackers to execute arbitrary code on vulnerable servers under certain conditions.
The PHP security team released patches for the vulnerabilities on October 21, 2026. Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, according to the CERT-EU security advisory.
The challenge initially attracted attention because participants struggled to retrieve the hidden key despite the known vulnerabilities. Early investigations raised questions about whether the server configuration exposed the vulnerable code paths required to execute the attacks successfully.
According to Bitcoin.com News, the challenge’s configuration was subsequently adjusted to provide a functioning PHP endpoint after concerns emerged about the way PHP was handling requests. The change allowed researchers to continue testing the intended attack surface.
The successful exploit involved multiple steps to take advantage of memory corruption in PHP. The vulnerabilities affect internal memory handling and can create opportunities for attackers to manipulate execution under specific conditions. Turning these flaws into a working exploit requires more than simply sending a malicious request, as researchers may need to overcome memory layout protections such as Address Space Layout Randomization (ASLR).
The winning researcher published exploit-related material on GitHub, providing technical details about the approach used to complete the challenge. The result demonstrated that the vulnerabilities could be exploited in the challenge’s particular environment, although exploitability and reliability can vary across different PHP deployments and server configurations.
The prize was reported as approximately 0.025 Bitcoin, worth around $2,000 at the time. Reports also described an issue involving the recovered private key and the wallet address containing the funds, which required attention during the challenge’s completion.
The PHP2Shell vulnerabilities have drawn wider attention because PHP is widely used to power websites and web applications, including content management systems and other internet-facing services. Successful exploitation can potentially give an attacker the ability to execute code with the privileges of the affected web server process.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Security agencies have urged organizations to identify vulnerable PHP installations and apply the available updates. The UK’s National Cyber Security Centre has also advised administrators to prioritize internet-facing systems, investigate suspicious activity, and review systems for possible signs of compromise.
