Researcher Earns $2000 for PHP Hack in Steal My Bitcoin Contest

A researcher using the pseudonym KillaBoi won the Steal My Bitcoin contest, where participants were challenged to hack a server with a vulnerable version of PHP to obtain a private key. The prize pool was approximately 0.025 BTC (~$2021).

The experiment was launched on October 24 by a Hacker News user named cloudlandsdev. The goal was to test the practical exploitation of recently disclosed PHP2Shell vulnerabilities.

“The aim is to leave [the money] on the street corner with a sign saying ‘Take me!’ and see how long it lasts there,” explained the organizer.

“The aim is to leave [the money] on the street corner with a sign saying ‘Take me!’ and see how long it lasts there,” explained the organizer.

Initially, the prize was $500 in bitcoin. Other users then contributed to the prize address, increasing the amount roughly fourfold.

The server ran PHP version 8.4.26, released before critical bugs were fixed. To obtain the key, participants needed to execute a special program called print-flag.

The site recorded a successful solution on October 25 at 15:47 UTC, 19 hours and 17 minutes after the start. KillaBoi published a description and demonstration code on GitHub. He stated that he managed to execute a command within the PHP process and retrieve the key stored on the server.

Key Was for a Different Address

Upon verification, it was found that the extracted key did not provide access to the prize funds. The organizer acknowledged the mistake: the key placed on the server was from a different wallet branch.

Nevertheless, the organizer recognized the victory and transferred the funds manually. He stated that server logs confirmed the successful execution of print-flag, and the participant knew the exact value of the stored key.

Additionally, the server initially served static HTML. A user named LiveOverflow pointed out that such a configuration did not utilize the vulnerable PHP path necessary for exploitation.

The organizer confirmed that a PHP page was added only on October 25 at 13:00 UTC. The successful solution appeared less than three hours after this change, meaning the hack took less than 19 hours.

The experiment is related to vulnerabilities CVE-2026-109618 and CVE-2026-109619, which can lead to remote code execution without authentication. On October 21, PHP developers released patches for supported branches 8.2–8.5.

Analysts at SlowMist have warned that critical PHP vulnerabilities could threaten Web3 projects through websites, servers, and transaction signing services.

Follow ForkLog on social media

StarkWare Reduces Cost Estimate for Quantum-Secure Bitcoin Transaction by 79%

Bitcoin Core Updates Vulnerability Disclosure Policy Due to AI

Bitcoin Red Team Returns to Chinese AI Models After OpenAI Restrictions

Bitcoin Red Team Identifies Thousands of Issues in 390 Bitcoin Projects

The zero-day market: discover, sell and keep quiet

Zero-Day Flaw Discovered in Bitcoin Mining Mechanism

ViaBTC Celebrates Ninth Anniversary with $69,999 Prize Contest

EXMO.com Launches EXM MEGADROP Campaign with $50,000 Prize Pool

SlowMist Warns of PHP Vulnerabilities Threatening Web3 Projects