Researcher Exploits Critical PHP Flaw in Bitcoin Hacking Challenge

A researcher known online as Killa exploited a critical PHP flaw on October 25 to execute code on the public Steal My Bitcoin challenge server. Killa extracted a concealed wallet credential and won a Bitcoin bounty. Challenge operator James Pavur confirmed the breach and said server logs corroborated Killa's findings. However, Pavur had placed the wrong Bitcoin private key on the server.

The competition followed the October 21 disclosure of critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. Researchers said the vulnerabilities could enable remote code execution on affected servers. The discoveries triggered urgent warnings from cryptocurrency security executives and emergency software updates. The challenge became a public test of those warnings amid claims that artificial intelligence was simplifying exploitation of serious security flaws. The server's apparent resistance to attacks encouraged doubts about how readily attackers could exploit the vulnerabilities.

Pavur originally used PHP's built-in web server to deliver ordinary HTML, restricting access to the vulnerable functionality. Cybersecurity researchers argued that the challenge's initial survival revealed little about whether the flaws could be exploited. Pavur later acknowledged the configuration problem. Pavur said an accessible PHP page was added at about 13:00 UTC on October 25. The successful breach occurred at 15:47:38 UTC, less than three hours later.

Ethical hacker and Hacktron co-founder Mohan "s1r1us" Pedhapati warned that discussion of the competition could encourage businesses to underestimate the threat. Pedhapati argued that the early challenge was unrealistic because heavy traffic overwhelmed the single-threaded PHP server, making exploitation unusually difficult. Pedhapati cautioned that those conditions did not demonstrate that attackers using frontier AI models would struggle under more favorable circumstances. Pedhapati also warned that treating a poorly configured, unsolved challenge as evidence of an exaggerated threat could create false confidence and delay patching.

Killa subsequently posted a proof of concept on GitHub describing the exploitation steps and a separate laboratory reproduction. Killa's account recorded a successful server response that included a Bitcoin private key. However, Killa acknowledged that some records from the original attempt had not been preserved. The published evidence does not demonstrate that an autonomous AI system completed the attack. The evidence also does not fully document how models were used in the successful attempt.