BlockBeats report, October 26: Security researcher killa (GitHub username KillaBoi) successfully exploited the recently disclosed critical PHP vulnerabilities PHP2Shell (CVE-2026-109618 and CVE-2026-109619) to compromise the public bounty website stealmybitcoin[.]com and claimed a Bitcoin reward worth approximately $2,021 (0.02511679 BTC).
It is reported that after the remote code execution vulnerability in PHP was disclosed on October 20, and since a reliable public exploit had not yet emerged, someone set up a website on October 24 using an unpatched PHP version and offered approximately $500 in Bitcoin as a "bounty reward" to invite hackers to verify the vulnerability’s actual exploitability. The bounty later increased to around $2,000 due to additional donations. Approximately 19.5 hours after the challenge began, killa developed a working exploit and successfully retrieved the private key from the server. The website creator later confirmed the challenge had been solved, acknowledged a mistake in placing the key, but admitted the attack was successful. Killa subsequently published the full PoC on GitHub.