● Covered by 2 sources · 2 reportsLow impact2 neutral
Bitcoin Bounty Challenge: Find Key on Server Worth $500
Key points
- A Bitcoin key worth $500 is hidden on a server.
- The key is accessible to the PHP user account.
- Access is through the 'print-flag' binary.
- An older PHP version, pre-PHP2SHELL CVEs, is used.
- A hacker claimed a $2,021.22 Bitcoin bounty.
- The challenge creator confirmed the win on October 25.
- The challenge was hosted a day earlier.
- Donations increased the pot to 0.02511679 BTC.
- The successful claim was recorded at 15:47 UTC on October 25.
- The challenge ran for approximately 19.28 hours.
- The experiment tested CVE-2026-109618 and CVE-2026-109619.
- Fixes for the vulnerabilities were released on October 21.
Bitcoin Key Challenge
A Bitcoin key, valued at approximately $500, has been placed on a server as part of a public challenge. The first individual to successfully retrieve the wallet will claim the Bitcoin.
Access Method
The hidden Bitcoin key is accessible to the PHP user account on the server. Participants must utilize the 'print-flag' binary to gain access to the key.
PHP Version Context
The server is running a version of PHP that predates the release of PHP2SHELL Common Vulnerabilities and Exposures (CVEs). This specific configuration is relevant to the challenge's design.
Donation Suggestion
Participants who successfully acquire the Bitcoin but do not require the funds are encouraged to consider donating the amount to GiveWell.org, a charity evaluator.
Updates
- A hacker claimed a $2,021.22 Bitcoin bounty.
- The challenge creator confirmed the win on October 25.
- The challenge was hosted a day earlier.
- Donations increased the pot to 0.02511679 BTC.
- The successful claim was recorded at 15:47 UTC on October 25.
- The challenge ran for approximately 19.28 hours.
- The experiment tested CVE-2026-109618 and CVE-2026-109619.
- Fixes for the vulnerabilities were released on October 21.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub KillaBoi/StealMyBitcoin-PoC CVE CVE-2026-1096189.8 CRITICAL CVE CVE-2026-1096198.1 HIGHHow outlets covered it
A hacker successfully breached a server running unpatched PHP, claiming a $2,021.22 Bitcoin bounty. The experiment tested the exploitability of recently disclosed critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow remote code execution.
A server hosts a Bitcoin key worth approximately $500, accessible via the PHP user account through a 'print-flag' binary. The challenge uses an older PHP version from before PHP2SHELL CVEs were released, inviting participants to find the key.