"Steal My Bitcoin": A Pentester Earns $2,000 in BTC by Exploiting PHP2Shell

<< Security is a process, not a product. >> (Bruce Schneier, Secrets and Lies, 2000)

A safe with the door wide open, on purpose. On Saturday, October 24, security researcher James Pavur launched a deliberately vulnerable server to PHP2Shell exploits with a bitcoin wallet inside and a message in three words: steal my bitcoin. Nineteen hours later, a 26-year-old pentester based in the UK walked away with the keys.

The community raised the bounty from $500 to $2,000 over the weekend, and the winner donated part of it to a lupus charity. The process, dear to Schneier, took three hours of actual work.

Key Points

• A challenge site launched on October 24 exposed an unpatched PHP server and a BTC reward
• Jaydip Modhwadia, aka Killa, took control of the machine on October 25 at 15:47 UTC
• His payload fits in a single Python script and fewer than twenty web requests
• The prize pool grew from $500 to $2,000 thanks to community donations
• CISA added both vulnerabilities to its catalog of exploited vulnerabilities on October 26

Steal My Bitcoin or the Bug Bounty Reduced to a Wallet

The principle of a classic bug bounty involves a platform, a form, and a committee that assesses severity before paying. Pavur removed all that. One server, one known vulnerability, one bitcoin address: the first to execute code on the machine serves themselves. The payment is the proof, and the blockchain acts as a record.

The mechanics were appealing. According to The Register, the initial stake of $500 was quadrupled by the community, reaching $2,000, or about 0.025 bitcoin at the rate of around $80,500 on Wednesday, October 28.

The winner is Jaydip Modhwadia, a developer and pentester based in the UK, known by the pseudonym Killa. The site’s counter displays << My Bitcoin was stolen after 19.28 hours >>, but the individual downplays it: he worked << about three hours in total >>. Pavur had added a PHP entry point that the exploit needed around 13:00 UTC on October 25, and remote code execution occurred at 15:47 UTC.

His payload fits in a single Python file and << a maximum of twenty HTTP requests >>. The script primarily bypasses ASLR, the protection that randomly mixes a program's memory addresses to complicate attackers' lives. The code is public on GitHub.

Modhwadia announced he would donate part of the winnings to the Lupus Foundation, which fights lupus, an autoimmune disease he suffers from himself. In 2021, the Poly Network hacker had put his $500,000 bounty back on the line after returning $610 million, challenging anyone to do better than him.

PHP2Shell Still Threatens 32 Million Servers

The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect all PHP versions since 5.4, meaning the engine behind a significant portion of the global web. According to Brian Krebs, Censys reported 2.58 million exposed hosts and 54.9 million web properties running PHP at the time of the emergency patches on October 21.

Patches exist: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. But Censys, cited by The Hacker News, still counted 32.51 million PHP services on a vulnerable version. CISA added both CVEs to its catalog of actively exploited vulnerabilities on Monday, October 26, with a severity rating of 9.2 out of 10, and gave U.S. federal agencies until October 29 to patch. The first real-world code execution was caught on honeypots on October 24, the same day Steal My Bitcoin launched.

Your exchange is unlikely to run on PHP, and several platforms rushed to say so after the alert raised by Changpeng Zhao. But the blog recommending a wallet and the forum where you read advice often run on WordPress, thus on PHP. A compromised server can serve a fake login page or replace a deposit address without anything changing on the screen.

If you administer a site, updating takes less time than Modhwadia took to enter. If you only visit, beware of sites that have been in << maintenance >> for a week and verify any deposit address from a second source. In France, ANSSI had cut off prefectures, taxes, and Bercy while they corrected, and a related vulnerability called Broccoli2Shell received its patch for Windows on October 26.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.