Hacker cracks PHP2Shell server and claims $2,021 Bitcoin bounty

A hacker known as KillaBoi breached a vulnerable server in the Steal My Bitcoin challenge and claimed a prize of 0.02511679 BTC ($2,021.22). The win was recorded on October 25 at 15:47 UTC, roughly 19.28 hours after the challenge launched to test exploits for the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619.

• Prize grew from about $502 to 0.02511679 BTC ($2,021.22) via donations
• The breach came about 19.28 hours after the challenge started
• Exploit abused PHP worker memory exhaustion during multipart uploads
• Recovered private key did not match the prize address; funds went to a Kraken wallet