Researcher cracks an unpatched PHP server and takes its $2,000 Bitcoin prize in 19 hours

Security researcher KillaBoi exploited an intentionally unpatched PHP server on stealmybitcoin.com and claimed its Bitcoin bounty after 19.28 hours, with the win logged at 15:47 UTC on October 25, 2026. The prize was 0.02511679 BTC, then worth $2,021.22, and the server ran PHP 8.4.26. The challenge tested the PHP2Shell vulnerabilities, two critical bugs tracked as CVE-2026-109618 and CVE-2026-109619, each with a 9.2 severity score, that enable remote code execution on unpatched servers. PHP maintainers issued emergency fixes on October 21, a day early, after details leaked. KillaBoi's write-up said a recovered private key did not derive the displayed prize address, a mistake the creator acknowledged by email; the site still lists the challenge as won.