A hacker using the name KillaBoi broke into a deliberately vulnerable PHP server on October 25 and claimed a Bitcoin prize worth $2,021.22, four days after fixes for the underlying flaws shipped.
The challenge ran on the Steal My Bitcoin website, set up by a creator posting as cloudlandsdev. It opened at about $502, and donations lifted the pot to 0.02511679 BTC. The site logged the winning claim at 15:47 UTC, roughly 19.28 hours in. The target ran PHP with two critical flaws, CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell. Under vulnerable configurations, they can allow remote code execution, meaning an attacker runs commands on a machine they do not own, with the web server account's privileges.
KillaBoi published a proof of concept on GitHub, with a local test environment. The attack pushed a PHP worker past its memory limit through multipart uploads and session data, leaving internal state inconsistent. Later requests leaked memory addresses through session cookies, and those addresses let the attacker forge a data structure that triggered a command during cleanup. The final request returned evidence the command had run.
The run was messy. Visitors exhausted the server's computing resources after each capacity increase, and limited storage meant the logs were incomplete. The recovered private key did not match the advertised prize address, though on-chain data shows the funds went to an address labeled as a Kraken cold wallet.
The creator built the challenge to test whether anyone could actually use the bug, writing that "we spent the last few days panicking." One server, one skilled winner and 19 hours is evidence, not a survey. The target was known, advertised and paying a reward, which real-world attacks rarely get. Still, a public exploit with a test environment lowers the bar for the next person.
Prior Bitcoin recoveries were offline puzzles. In 2024, Joe Grand and a researcher named Bruno reverse-engineered an old RoboForm password generator to recover 43.6 BTC. In May 2026, a holder known as cprkrn recovered five BTC after Claude helped locate a 2019 backup file. This one hit a live server under traffic, and turning the flaws into a reliable attack takes a chain of steps, not a single pasted exploit. How many production configurations match that chain is the open question.