Steal My Bitcoin recorded a win in its PHP2Shell challenge on October 25, 2026, at 15:47 UTC, after 19.28 hours. The site listed a prize pot of 0.02511679 BTC, valued there at $2,021.22 at the time. Tom’s Hardware identified KillaBoi as the winner and reported that challenge creator cloudlandsdev confirmed the result.
What KillaBoi’s write-up describes
KillaBoi’s technical write-up describes a chain involving multipart uploads, PHP session handling and memory faults that led to command execution. The author says the detailed request from the live run was reconstructed afterward because the full original outgoing request and response headers were not captured.
The repository also reports seven verified callbacks in ten runs of a local setup using Alpine PHP 8.4.26, PHP’s built-in CLI server and four workers. That result applies to this specific lab configuration.
The prize address did not match the recovered key
KillaBoi says the private key recovered during the challenge did not derive the advertised prize address. The site’s recorded result and its listed prize pot describe the challenge outcome; KillaBoi’s account supplies the key-address mismatch.
The challenge’s place in the PHP2Shell timeline
The challenge concerned CVE-2026-109618 and CVE-2026-109619. PHP published fixes for both vulnerabilities on October 21, four days before the recorded win. NeoTeo’s earlier coverage explains the fixed PHP versions and security response.
