A hacker breached the Steal My Bitcoin challenge server and claimed a Bitcoin bounty on October 25, less than three hours after the challenge operator modified the PHP configuration to expose vulnerable code. The successful exploit followed the October 21 disclosure of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which researchers warned could allow remote code execution on affected servers.
The researcher, identified online as Killa, extracted a hidden wallet credential from the compromised server. Challenge operator James Pavur confirmed the attack was successful based on server logs and the researcher's findings. The researcher later published a proof of concept on GitHub documenting the exploitation process and a separate laboratory reproduction of the attack.
The challenge had initially drawn skepticism about the exploitability of the disclosed vulnerabilities. Security researchers criticized the early server configuration, which served ordinary HTML through PHP's built-in web server and limited attackers' access to the vulnerable functionality. This setup appeared resistant to attacks and fueled questions about whether the flaws posed a serious threat.
Pavur acknowledged the configuration issue and added an accessible PHP page around 13:00 UTC on October 25. The successful breach occurred at 15:47:38 UTC the same day.
Cybersecurity experts cautioned that the challenge's initial problems and early survival should not be used to underestimate the security threat posed by these vulnerabilities. Ethical hacker Mohan Pedhapati warned that an unsolved, poorly configured challenge could give organizations false confidence and encourage them to delay necessary security patches.
The published evidence documenting the attack does not establish whether an autonomous AI system completed the exploit or provide comprehensive records of how AI models may have been used during the successful attempt.
