Researcher exploits PHP flaw to win Bitcoin challenge, operator confirms server breach

Researcher Killa successfully exploited critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 to breach the Steal My Bitcoin challenge server on October 25, extracting a hidden wallet credential less than three hours after the operator reconfigured the server. Although the operator confirmed the exploit, the winner could not claim the Bitcoin prize due to an incorrect private key stored by the operator.