Skip to content
Website Challenges Hackers to Steal Bitcoin with PHP Vulnerabilities

Website Challenges Hackers to Steal Bitcoin with PHP Vulnerabilities

First seen 25 Oct 2026, 20:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 25, 2026 at 21:42 UTC
  • •Steal My Bitcoin offers a $2,000 bounty for exploiting PHP vulnerabilities.
  • •CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities with a CVSS score of 9.2.
  • •No successful exploitation has occurred after 17 hours, raising questions about the challenge's legitimacy.

A website named Steal My Bitcoin is offering a $2,000 bounty for successfully exploiting a deliberately vulnerable PHP installation. Despite the challenge being live for over 17 hours, no one has claimed the prize. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were published on October 21, 2026, and are rated as critical with a CVSS score of 9.2. However, an analysis suggests that the server's configuration may prevent exploitation of these vulnerabilities. Participants are restricted to attacking only the web application and PHP container, while other methods are forbidden. The challenge has raised questions about whether it is genuinely exploitable or if it is rigged. As of now, the Bitcoin wallet remains untouched.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
CVE-2026-109618 and CVE-2026-109619 published
Two critical vulnerabilities in PHP were disclosed, allowing potential remote code execution.
News.Bitcoin
2026-10-25
Steal My Bitcoin challenge goes live
The website invites hackers to exploit its PHP vulnerabilities for a $2,000 Bitcoin bounty, which remains unclaimed after 17 hours.
X

More articles in this cluster (4)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 3

Common questions

What vulnerabilities are involved?
The vulnerabilities are CVE-2026-109618 and CVE-2026-109619, both critical with a CVSS score of 9.2.
Why hasn't anyone claimed the bounty?
An analysis suggests the server configuration may prevent exploitation of the advertised vulnerabilities.
What are the rules for participation?
Participants must only attack the web application and PHP container, while other methods like server sabotage are forbidden.