Security researcher exploits PHP2Shell vulnerability to hack bounty website, walks away with approximately $2,000 in Bitcoin bounty.

BlockBeats news, October 26: Security researcher killa (GitHub username KillaBoi) successfully exploited the recently exposed high-severity PHP vulnerabilities PHP2Shell (CVE-2026-109618 and CVE-2026-109619) to breach the public bounty website stealmybitcoin[.]com and claimed a Bitcoin reward worth approximately $2,021 (0.02511679 BTC).

It is reported that after the PHP core remote code execution vulnerability was exposed on October 20, because publicly available reliable exploit code had not appeared, someone set up the website on October 24, deliberately using an unpatched PHP version, and posted approximately $500 in Bitcoin as a "bounty reward," inviting hackers to verify the vulnerability's real-world exploitability. The bounty later rose to approximately $2,000 due to donations. About 19.5 hours after the challenge began, killa wrote working exploit code and successfully obtained the private key on the server. The website creator later confirmed that the challenge had been solved and pointed out that there had been a mistake in how the key was placed, but acknowledged that the attack was successful. killa subsequently published the full PoC on GitHub.