Security Researcher Exploits PHP2Shell Vulnerability to Breach Bounty Website, Earns Approximately $2000 in Bitcoin Rewards

Security researcher killa successfully exploited the PHP2Shell vulnerability to breach the bounty website stealmybitcoin.com, claiming a Bitcoin reward valued at approximately $2021 (0.02511679 BTC). The vulnerability (CVE-2026-109618 and CVE-2026-109619) was disclosed on October 20, and due to the delayed appearance of the attack code, the website was set up on October 24 using an unpatched version of PHP, offering a bounty of about $500 in Bitcoin to verify the vulnerability. The reward later increased to around $2000 due to donations. Approximately 19.5 hours after the challenge began, killa wrote usable attack code and successfully retrieved the private key from the server. The website creator confirmed that the challenge was resolved, acknowledged the success of the attack, and pointed out that there was an error in placing the key. Killa subsequently published the complete PoC on GitHub.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.