A developer who invited hackers to steal more than $2,000 (£1,500) in Bitcoin from his deliberately unpatched PHP server got an unexpected result on 25 October 2026. A participant successfully exploited the server but discovered that the recovered private key did not control the Bitcoin address holding the prize.
The experiment, hosted on StealMyBitcoin.com over 24–25 October, tested whether attackers could exploit two critical PHP vulnerabilities known as PHP2Shell. The challenge ended after 19.28 hours, although an initial server configuration had made the intended attack more difficult.
The organiser, identified on Hacker News as 'cloudlandsdev', initially offered around $500 (approximately £374). Contributions from others increased the prize to $2,021.22 (approximately £1,510).
Despite the growing reward, the Bitcoin remained unclaimed for hours as participants encountered technical obstacles.
Why Hackers Struggled to Crack the PHP Server
Participants had to exploit the vulnerable server, execute a programme called 'print-flag' and recover a hidden Bitcoin private key.
The server ran PHP 8.4.26, a version affected by two critical vulnerabilities that could allow attackers to execute code remotely without authentication under vulnerable conditions.
However, the experiment initially had a significant configuration problem.
Security researcher LiveOverflow questioned whether the setup exposed the PHP functionality required for the intended attack. The developer had initially served a static HTML page through PHP's built-in web server, leaving the expected vulnerable code path inaccessible, according to LiveOverflow's assessment.
The organiser later confirmed that he had added a PHP endpoint around 18 to 19 hours into the experiment. This meant the website's 19.28-hour timer measured the entire challenge, not just the period when the intended exploitation route was available.
Heavy traffic created further complications. The organiser reported that incoming requests repeatedly exhausted the server's computing resources, causing interruptions.
Meanwhile, nginx request-size restrictions limited the requests participants could send. These obstacles complicated exploitation but did not establish that the underlying vulnerabilities were harmless.
Hacker Wins $2,000 Challenge but Finds the Wrong Bitcoin Key
The breakthrough came on 25 October at approximately 15:47 UTC.
A participant identified as 'killa', who published a technical account on GitHub under the username KillaBoi, successfully exploited the server and recovered the hidden private key.
According to the winner's account, the attack exploited weaknesses in PHP's memory handling. The technique involved extracting information from server memory and using it to execute commands remotely.
Its success depended on the server's PHP build, memory layout and process behaviour.
However, the successful attack exposed another problem. The recovered private key did not correspond to the Bitcoin address holding the advertised prize.
The organiser subsequently acknowledged that he had stored a wallet-branch private key rather than the specific key controlling the funded address. As a result, the winner had obtained the secret required by the challenge but could not directly use it to access the prize wallet.
The organiser said server logs supported the participant's claim. They also showed the first and only successful execution of 'print-flag' that returned the hidden key.
He accepted the result as a legitimate victory and later confirmed that he had transferred the prize to the winner.
The winner's technical account also acknowledged gaps in the original records. The complete outgoing request and response headers were not preserved, although the available evidence supported successful command execution.
The challenge website now declares that the contest has been won and states that no Bitcoin remains on the server.
What the Bitcoin Challenge Reveals About PHP2Shell
The experiment followed the disclosure of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on 21 October 2026.
Both received severity scores of 9.2 out of 10. The flaws affect PHP, a programming language widely used by websites, content management systems and online applications.
The vulnerabilities involve weaknesses in memory handling and request processing. Depending on the environment, successful exploitation could allow attackers to execute malicious code or expose sensitive information.
According to the official PHP security advisory, security fixes were released on 21 October in PHP versions 8.4.27, 8.5.12, 8.3.36 and 8.2.35.
The Bitcoin challenge illustrated an important distinction between a critical vulnerability and an exploit that works reliably against every affected server.
Web server configurations, request restrictions and memory conditions can influence whether an attack succeeds. Once the necessary PHP endpoint became available, a participant demonstrated successful compromise of the challenge server.
The experiment ended with an awarded prize and an unexpected Bitcoin wallet mistake. It also showed why a server's resistance to initial attacks should not be mistaken for security.
For website administrators, the lesson is more serious. A vulnerable server may resist some attacks, but those difficulties are no substitute for applying security updates.
