'Steal My Bitcoin' PHP challenge cracked: what it proves

A public bounty meant to test how dangerous two newly disclosed PHP flaws really are has been won: a researcher known online as "Killa" executed code on the "Steal My Bitcoin" server on Oct. 25 and pulled out a hidden wallet credential, CryptoSlate reports. Challenge operator James Pavur confirmed the attack, saying his server logs back it up.

What the challenge was

The contest followed the Oct. 21 disclosure of CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities that researchers said could allow remote code execution on affected servers. Crypto security executives urged immediate patching. Pavur put a small bitcoin prize on a deliberately unpatched server to see whether the warnings held up, and for days it did not fall, which some read as proof the bugs were overhyped.

Why the early survival meant little

Security researchers criticised the first configuration because it barely exposed the vulnerable code. Hacktron co-founder Mohan "s1r1us" Pedhapati called the "overhyped" reading "a very dangerous narrative" and warned it could lead businesses to delay patching. Heavy traffic also overwhelmed the single-threaded server early on. Once a realistic page went up, the server fell in under three hours.

There was a twist: the key on the server turned out to be the wrong wallet key, so Pavur had to transfer the 0.02511679 BTC prize himself, The Defiant reports. Killa has published a proof of concept on GitHub, though the records do not show whether an autonomous AI tool carried out the attack.

What to take from it

If you run anything on PHP, including payment plugins or self-hosted shops that accept crypto, patch now rather than wait for proof of mass exploitation. And never leave wallet keys on a web server: keep savings in a hardware wallet and follow our checklist on how to store crypto safely. Phishing kits often follow big vulnerability news, so our guide to spotting crypto scams is worth a refresh too.