The “Steal My Bitcoin” challenge offers a bounty to anyone who can breach a deliberately vulnerable PHP website using the recently disclosed PHP2Shell flaws. The challenge follows previous recoveries of locked Bitcoin fortunes through software vulnerabilities and AI-assisted investigation, but no successful claim has been confirmed.
(Image credit: Shutterstock) Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter A hacker has successfully breached a vulnerable server, claiming a prize pot worth $2,021.22 in Bitcoin after exploiting PHP2Shell vulnerabilities, a posting on the Steal My Bitcoin website has shown. The challenge’s creator confirmed the win on October 25, ending an experiment designed to test claims that exploiting critical software vulnerabilities is becoming easier. The challenge, hosted on the website a day earlier and announced through a forum post , initially offered approximately $502 worth of Bitcoin. Donations subsequently increased the pot to 0.02511679 BTC, worth $2,021.22 at the time of the win. The creator’s website recorded the successful claim at 15:47 UTC on October 25, after the challenge had been running for approximately 19.28 hours. The experiment follows the disclosure of CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities that can allow remote code execution under certain conditions. The flaws received critical severity ratings, and fixes were released on October 21. Turning the vulnerabilities into a reliable attack, however, requires more than simply running a publicly available exploit against an arbitrary server. Latest Videos From Tom’s Hardware Watch full video here: The challenge’s creator, posting under the name ‘cloudlandsdev’, had said the project was designed to see whether anyone could use the vulnerabilities to compromise the server and claim its Bitcoin. “Made this because I’m curious if anyone out there has figured out how to actually use this PHP RCE, we spent the last few days panicking. Have fun!” the creator wrote. PHP2Shell refers to two vulnerabilities in PHP’s request-handling and memory-management processes. Under vulnerable configurations, an attacker could potentially exploit these flaws to execute code with the privileges of the web server account. The challenge quickly attracted attention, but the resulting traffic also became a problem. In an update, the creator said visitors were exhausting the server’s available computing resources shortly after each capacity increase. Limited storage also prevented the server from retaining all its logs, complicating efforts to document a successful attempt. The winner, ‘KillaBoi’, published a proof of concept on GitHub describing the attack against the live challenge and providing a local test environment. The exploit took advantage of PHP’s handling of multipart uploads and session data, where, by pushing a PHP worker beyond its memory limit, the attacker could leave internal state in an inconsistent condition. Subsequent requests then exposed memory contents through session cookies, providing information about the locations of PHP’s memory structures and executable code. Stay On the Cutting Edge: Get the Tom’s Hardware Newsletter Get Tom’s Hardware’s best news and in-depth reviews, straight to your inbox. Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors Bitcoin recovery efforts have previously involved reverse-engineering software rather than exploiting a live server. In 2024, hardware hacker Joe Grand, known as ‘Kingpin”, and researcher Bruno recovered access to 43.6 BTC belonging to an owner identified as Michael, who had forgotten a 20-character wallet password. The researchers reverse-engineered an older version of RoboForm’s password generator and identified a flaw that made the password predictable. They recovered the wallet in November 2023, when the Bitcoin was worth approximately $1.6 million. Its value had climbed to nearly $3 million by the time the recovery was reported in May 2024. A more recent case involved a Bitcoin holder who r ecovered five BTC worth roughly $400,000 in May 2026 after losing access to the wallet for years. The pseudonymous owner, known as ‘cprkrn’, said Anthropic’s Claude AI helped identify a backup file from December 2019, which could be decrypted using a password the owner had previously written down in a notebook. The backup contained the keys needed to access the Bitcoin. The latest event comes as security teams face pressure to patch PHP installations following the public disclosure of PHP2Shell. A separate report on the vulnerability disclosure controversy detailed how premature publication disrupted the coordinated release process. That said, for now, evidence of the latest successful attack suggests that exploiting these PHP vulnerabilities may not be that hard after all. See all comments (0) Newton Gitonga Freelance Writer Newton Gitonga is a tech journalist covering gadgets, PC hardware, AI, data centers, and the wider tech industry. His interest in technology started early, taking apart things around the house to see how they worked, often to his dad’s frustration. His curiosity sometimes got the better of him, including a few failed attempts to fix laptops, one of them a gifted Dell XPS. He has previously written for Notebookcheck, ZyCrypto, CoinCentral, and Crypto News Flash. No comments yet Comment from the forums