A developer deliberately put an unpatched PHP server online, left a Bitcoin wallet private key on it, and invited anyone to try to steal the funds in a public challenge called “Steal My Bitcoin.” Records on the official challenge site show the machine was compromised about 19.28 hours after the contest began, and the 0.02511679 BTC bounty was moved out. The website valued that amount at about $2,021.
A public test of whether the PHP flaw could be used in the real world
According to the official Steal My Bitcoin website, the challenge was launched in the early hours of Oct. 25, Taiwan time, by a developer using the Hacker News account cloudlandsdev. He intentionally deployed a PHP server without recent security updates, placed a private key for a Bitcoin wallet on the system, and opened the setup to the public. Anyone who could use the key and transfer the Bitcoin out of the wallet would keep the full bounty.
In the original post, the developer said the point was to find out whether anyone could actually exploit the recent PHP remote code execution issue, rather than leaving the discussion at the level of theory.
Japanese media outlet GIGAZINE reported that the bounty initially stood at about $500, or roughly NT$16,000 using an Oct. 27 exchange rate of NT$32.6 per U.S. dollar. Donations later pushed the reward to about $2,021, or roughly NT$66,000.
The organizer also set limits for the challenge. Attacks were restricted to the web application and the PHP execution environment. Attacks on the underlying host or attempts to take the service down were not allowed.
The server fell about three hours after an executable page was added
Official site records show the Bitcoin was transferred out about 19.28 hours after the challenge started, placing the breach at 11:47 p.m. Taiwan time on Oct. 25, less than a day after launch.
For more than 17 hours after the challenge opened, nobody succeeded. At one point, security researchers questioned whether the server configuration made the exploit path unreachable in practice.
Security researcher LiveOverflow said the original server did not expose a page that would execute PHP code. The organizer later added that page at around 9 p.m. Taiwan time on Oct. 25. Roughly three hours later, the system was breached.
The attacker used the handle KillaBoi and later published the reproduction process on GitHub. In broad terms, the method relied on how PHP handles low-memory conditions, allowing the attacker to gradually obtain internal server information, then execute commands on the machine and recover the private key.
The official website included a link to the bounty wallet. Data from blockchain explorer mempool.space shows the wallet received a total of 0.02511679 BTC and that the full amount has now been transferred out, leaving the balance at zero.
The challenge machine was running PHP 8.4.26
The server used in the challenge was running PHP 8.4.26, which was one version behind the emergency patch release.
PHP issued repeated warnings in October over a severe flaw referred to externally as “PHP2Shell,” and on Oct. 21, Taiwan time, released emergency updates for four branches: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. For the 8.4 branch, upgrading to 8.4.27 covers the fixes. Other branches map to their corresponding versions in that release set. That left the challenge server’s 8.4.26 outside the patched range.
PHP disclosed another issue on Oct. 24
On Oct. 24, PHP also disclosed a separate vulnerability tied to session upload progress tracking, CVE-2026-115560. The project described it as an unlikely remote execution path that would require three conditions to be met at the same time. Default settings do not satisfy those conditions, and no patch has been released yet.
PHP said site operators who have not disabled session upload progress should consider turning it off as a precaution. The organizer said more challenges may follow and that he also plans to share what he learned from running this one.
What the challenge showed
The Steal My Bitcoin challenge centered on a deliberately unpatched PHP 8.4.26 server with a Bitcoin wallet private key placed on it as a bounty target. The stated purpose was to test whether a flaw that some considered difficult to exploit could, in practice, be used to steal a private key.
As for versions, PHP released emergency fixes on Oct. 21 for 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The challenge machine remained on 8.4.26, which was still outside the patched set. For users on the 8.4 branch, moving to 8.4.27 covers the relevant fixes.
