A hacker breached a public PHP server to win a Bitcoin bounty after the challenge sparked doubts about critical software vulnerabilities.
The researcher, identified online as Killa, successfully executed code on the Steal My Bitcoin challenge server on October 25, extracting a hidden wallet credential in an experiment that drew attention to claims that artificial intelligence was making serious security flaws easier to exploit.
Challenge operator James Pavur confirmed the successful attack, saying server logs supported the researcher’s findings.
However, the result came after problems with the challenge’s initial configuration led security experts to question whether it meaningfully tested the underlying vulnerability.
The competition followed the October 21 disclosure of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which researchers said could allow attackers to execute code remotely on affected servers.
The discoveries prompted urgent warnings from cryptocurrency security executives and emergency software updates.
The Bitcoin challenge then became a public test of those warnings, and its apparent resistance to attacks fueled skepticism about how easily the vulnerabilities could be exploited.
Flawed Bitcoin challenge falls within hours of server changes
Pavur initially configured the challenge to serve ordinary HTML through PHP’s built-in web server, limiting attackers’ ability to reach the vulnerable functionality.
The setup drew criticism from cybersecurity researchers, who argued that its early survival provided little evidence of the flaws’ exploitability.
Ethical hacker and Hacktron co-founder Mohan “s1r1us” Pedhapati warned that the discussion surrounding the competition risked encouraging businesses to underestimate the security threat.
“This is a very dangerous narrative. Just look at the engagement it’s getting,” Pedhapati said.
He argued that the challenge was unrealistic in its early hours, when heavy traffic overwhelmed the single-threaded PHP server and made successful exploitation unusually difficult.
Pedhapati also cautioned that these problems did not prove attackers with frontier AI models would struggle to exploit the same vulnerabilities under more favorable conditions.
He stated:
“i don’t think you’re explicitly telling people not to patch. but using an unsolved, badly configured challenge as evidence that the vulnerability is overhyped can give people false confidence and lead them to delay patching.”
Pavur subsequently acknowledged the configuration issue, confirming that he added an accessible PHP page around 13:00 UTC on October 25.
The successful attack followed at 15:47:38 UTC, less than three hours after the change.
The winning researcher later published a proof of concept on GitHub, describing the exploitation process and a separate laboratory reproduction of the attack.
The account documented a successful server response containing a Bitcoin private key, although the researcher acknowledged gaps in the preserved records from the original attempt.
The published evidence also does not establish that an autonomous AI system completed the attack or provide a comprehensive record of how models were used during the successful attempt.c
