Security researcher exploits PHP2Shell to breach bounty website and claim 0.02511679 BTC reward

Article

Security researcher exploits PHP2Shell vulnerability to breach bounty website and claim approximately 2000 USD in Bitcoin rewards

BlockBeats reported that October 26, security researcher killa (GitHub username KillaBoi) successfully exploited the recently disclosed PHP critical vulnerability PHP2Shell（CVE-2026-109618 and CVE-2026-109619) to breach the public bounty website stealmybitcoin[.]com and claim Bitcoin rewards worth approximately 2021 USD(0.02511679 BTC).

Reportedly, after the October 20 PHP core remote code execution vulnerability was disclosed, no publicly reliable exploit code emerged for some time. Someone therefore set up the website on October 24 using an unpatched PHP version, and offered approximately 500 USD in Bitcoin as a “bounty reward,” inviting hackers to verify the vulnerability's real-world exploitability. The reward subsequently rose to approximately 2000 USD. About 19.5 hours after the challenge began, killa developed a working exploit and successfully obtained the private key on the server. The website creator later confirmed that the challenge had been solved and noted an error in how they had placed the key, but acknowledged that the attack was successful. killa subsequently published the complete PoC on GitHub.

Original link https://m.theblockbeats.info/flash/373708

Key points

BlockBeats reported that security researcher killa (GitHub username KillaBoi) exploited the PHP2Shell vulnerability (CVE-2026-109618 and CVE-2026-109619) to breach stealmybitcoin[.]com.
The report said that killa obtained 0.02511679 BTC, worth approximately 2021 USD。
The website used an unpatched PHP version and set a Bitcoin bounty for vulnerability verification.
About 19.5 hours after the challenge began, killa developed a working exploit and obtained the server's private key.
The website creator later confirmed that the challenge had been solved and acknowledged that the attack was successful.
killa subsequently published the complete PoC。

AI-assisted interpretation

The following is analysis, separate from reported facts. Verify important claims independently.

This is a report of a vulnerability exploitation incident: a bounty website deliberately using an unpatched PHP version was breached, the server's private key was obtained, and the researcher claimed the Bitcoin reward.

Why it matters to readers

The incident shows that publicly exposed and unpatched PHP services may become targets for vulnerability verification and attacks; the material does not indicate a broader range of affected services.

It can be understood as a public vulnerability challenge: the website intentionally left the vulnerability in place, and the researcher used exploit code to demonstrate that it could affect the server.

Risks and unknowns

The available material does not provide an official vulnerability advisory, affected PHP versions, or patch information.
The available material does not include PoC or a code repository, and the report lacks independent technical verification.
The material does not specify whether the vulnerability affects other websites or services.

Security researcher exploits PHP2Shell to breach bounty website and claim 0.02511679 BTC reward

Article

AI-assisted interpretation

Why it matters to readers

Risks and unknowns

Related Developments

Related concepts

Keep following

Security Center