Researcher claims Steal My Bitcoin prize by exploiting patched PHP flaw

A security researcher known as KillaBoi won about $2,021 in bitcoin from the Steal My Bitcoin challenge on Oct. 25, showing that the critical PHP vulnerabilities patched four days earlier can be turned into remote command execution on a server running an unpatched build. The challenge site records the win at 15:47 UTC with a prize pot of 0.02511679 BTC and a total elapsed time of 19.28 hours. The page now reads that the bitcoin was stolen and that more challenges may appear in the future.

Challenge operator James Pavur set up stealmybitcoin.com to test whether the flaws tracked as CVE-2026-109618 and CVE-2026-109619 were exploitable in practice. The PHP security team shipped emergency fixes on Oct. 21 after governments in Europe took websites offline, as covered in an earlier report on those patches. Pavur deliberately ran PHP 8.4.26, a version predating the fixes, so that an attacker could execute commands on a vulnerable server, CryptoSlate reported. The competition followed the Oct. 21 disclosure of the two critical vulnerabilities, which researchers said could allow remote code execution on affected servers.

The breach did not go smoothly at first. Pavur initially configured the challenge to serve ordinary HTML through PHP's built-in web server, which limited access to the vulnerable functionality. Security researchers argued that the site's early survival proved little about the flaws' real-world risk. Ethical hacker Mohan "s1r1us" Pedhapati warned that treating an unsolved, badly configured challenge as evidence the vulnerability was overhyped could give operators false confidence and delay patching, CryptoSlate reported. Heavy traffic on the single-threaded PHP server also made successful exploitation unusually difficult during those early hours, the report said.

Pavur acknowledged the configuration problem and said he added an accessible PHP page around 13:00 UTC on Oct. 25. The successful attack followed at 15:47:38 UTC, less than three hours later. The website's own counter shows 19.28 hours from the challenge opening to the recorded win. The winner published a proof of concept on GitHub that reproduces the request sequence: a multipart upload drives PHP past its memory limit, follow-up requests recover a heap address and a PHP code address from session cookies, and a final request plants a forged structure that routes cleanup through PHP's system handler. The repository describes at most 20 HTTP requests in a full run and reports that roughly seven runs in ten verified end to end against a local lab. The writeup explains that both leak stages race against three other PHP workers, so a single attempt is not expected to succeed every time.

The writeup is candid about the gaps. The original live run never captured its full outgoing request or response headers, the complete request was reconstructed afterward, and the recovered wallet key did not derive the prize address shown on the challenge homepage at the time, the GitHub repository states. "That was a mistake on the creator's side, and it was acknowledged over email," the winner wrote. Pavur verified the breach in server logs and paid the prize himself, while the site lists the prize wallet address on mempool.space and links the winner's writeup. A local nginx and PHP lab reproduced the callback and the socket-output method with dummy data after the fact, the repository says.

The challenge also became a public argument about how much artificial intelligence contributed. The published evidence does not establish that an autonomous AI system completed the attack or provide a comprehensive record of how models were used during the successful attempt, CryptoSlate noted. Pavur hinted that he might run another challenge, while the challenge site says more may appear and that no bitcoin remains on the server for now. The episode landed while the PHP Foundation was still urging developers to apply the October fixes and, days later, to disable a feature after another vulnerability warning that Cybernews separately covered.