A security researcher, operating under the alias KillaBoi, successfully exploited vulnerabilities on an intentionally unpatched PHP server and won a Bitcoin bounty valued at $2,021.22. The feat was accomplished in just over 19 hours and served as a real-world demonstration of recent critical PHP2Shell flaws.
Challenge exploited within a day
The exploit took place on Stealmybitcoin.com, a website designed to test the severity of PHP2Shell security holes. The site confirmed that the bounty was collected, logging the win at 15:47 UTC on October 25.
The prize consisted of 0.02511679 BTC, offered to anyone able to breach the vulnerable system. After the successful claim, the website displayed a message stating there were no remaining Bitcoin rewards, but hinted at future challenges for security researchers.
KillaBoi detailed the exploit process in a proof-of-concept write-up published on GitHub, specifying that the target server operated on PHP version 8.4.26.
The write-up explained that the private key obtained during the exploit did not correspond to the prize address advertised on the homepage, which the site creator acknowledged as an error via email. Regardless, the bounty remained attributed to the winner on the website.
Visibility for the contest increased after it was shared by the @hackerfantastic account, associated with cybersecurity firm hacker.house. The post described the competition’s structure and the underlying risks posed by the newly disclosed vulnerabilities.
PHP2Shell flaw leads to global emergency response
The timing of the challenge followed the disclosure of two major PHP vulnerabilities—known collectively as PHP2Shell—just days earlier. After details of the bugs surfaced online, PHP developers released emergency security patches on October 21, ahead of their planned schedule.
Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities each received a severity score of 9.2 out of 10, allowing attackers to execute code remotely on compromised PHP servers.
PHP drives the backend for approximately 70% of all websites using a known server-side language. In reaction to the vulnerability disclosures, several European governments, including Finland, the Netherlands, and France, temporarily took official websites offline as a precautionary measure.
Cybersecurity company Cloudflare observed millions of attempted exploitation incidents mere hours after the vulnerabilities were announced.
| Vulnerability Name | CVE ID | Severity Score | Impact |
|---|---|---|---|
| PHP2Shell Bug 1 | CVE-2026-109618 | 9.2/10 | Remote code execution |
| PHP2Shell Bug 2 | CVE-2026-109619 | 9.2/10 | Remote code execution |
A coalition that included OpenAI was given two months to coordinate patches and protections. OpenAI, a prominent artificial intelligence research organization, stated that the same AI techniques used to uncover the vulnerabilities could be applied by attackers to automate exploit creation.
Mini dictionary: OpenAI is an artificial intelligence research company known for developing advanced AI systems like ChatGPT and contributing to cybersecurity research through automated code analysis and threat detection tools.
The operator of Stealmybitcoin.com is preparing a separate account detailing the technical and administrative steps involved in hosting the bug bounty challenge.
