A security researcher has exploited an intentionally unpatched PHP server and claimed Bitcoin bounty in just over 19 hours, in a public test of whether the recently disclosed PHP2Shell flaws are as dangerous as advertised.

Bounty claimed in 19.28 hours

Stealmybitcoin.com, the site that hosted the challenge, verified that the bounty had been claimed. Its results page shows the Bitcoin was taken after 19.28 hours, with the win logged at 15:47 UTC on Sunday, October 25. The prize pot stood at 0.02511679 BTC, worth $2,021.22 at the time.

The page now reads: "For now, there are no bitcoin on this server," adding that more challenges may follow.

The winner, operating under the handle KillaBoi, published a proof-of-concept write-up on GitHub. The target server was running PHP 8.4.26. According to the write-up, the single private key recovered did not derive the prize address displayed on the homepage — an error attributed to the challenge's creator, who acknowledged the mistake via email. The site nonetheless lists the challenge as won.

The contest reached a wider audience through the @hackerfantastic account on X, which is connected to the company hacker.house. In an October 25 post, the account explained how the challenge worked.

Win follows emergency PHP2Shell patches on October 21

The experiment came days after a scramble over two critical PHP bugs. Details of the vulnerabilities leaked online, prompting PHP's maintainers to release emergency fixes on October 21, a day ahead of schedule, as previously reported by Cryptopolitan.

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed PHP2Shell, each received a severity score of 9.2 out of 10 and enable remote code execution on unpatched servers. The challenge's result gives those scores a concrete real-world shape: an unpatched server fell in under a day even with fixes publicly available since October 21.

PHP powers roughly 70% of websites with a known server-side language, and many operators shut down their sites as a precaution. Finland, the Netherlands and France all temporarily pulled government websites offline. Cloudflare said it saw millions of what it called exploitation attempts in the hours after the bugs were made public. The demonstration offered a small-scale, verifiable glimpse of the exposure that prompted those precautionary shutdowns.

A coalition that included OpenAI had been given two months to develop fixes. OpenAI said that the same AI tools that found the flaws could also help attackers quickly build exploits, as covered in Cryptopolitan's report on the PHP2Shell disclosure.

The operator of stealmybitcoin.com has promised a separate write-up of the experience of hosting the challenge, complementing KillaBoi's attacker-side account. The results page also notes that more challenges may follow, leaving the door open to further public tests.