The server was breached less than three hours after a configuration change, but an incorrect wallet key prevented the winner from claiming the Bitcoin prize directly.

A hacker breached a public PHP server to win a Bitcoin bounty after the challenge sparked doubts about critical software vulnerabilities.

The researcher, identified online as Killa, successfully executed code on the Steal My Bitcoin challenge server on October 25, extracting a hidden wallet credential in an experiment that drew attention to claims that artificial intelligence was making serious security flaws easier to exploit.

Challenge operator James Pavur confirmed the successful attack, saying server logs supported the researcher's findings.

However, the result came after problems with the challenge's initial configuration led security experts to question whether it meaningfully tested the underlying vulnerability.

The competition followed the October 21 disclosure of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which researchers said could allow attackers to execute code remotely on affected servers.

The discoveries prompted urgent warnings from cryptocurrency security executives and emergency software updates.

The Bitcoin challenge then became a public test of those warnings, and its apparent resistance to attacks fueled skepticism about how easily the vulnerabilities could be exploited.

Pavur initially configured the challenge to serve ordinary HTML through PHP's built-in web server, limiting attackers' ability to reach the vulnerable functionality.

The setup drew criticism from cybersecurity researchers, who argued that its early survival provided little evidence of the flaws' exploitability.

Ethical hacker and Hacktron co-founder Mohan “s1r1us” Pedhapati warned that the discussion surrounding the competition risked encouraging businesses to underestimate the security threat.

Source link