A hacker breached a public PHP server to win a Bitcoin bounty after the problem sparked doubts about important software program vulnerabilities.
The researcher, recognized on-line as Killa, efficiently executed code on the Steal My Bitcoin problem server on October 25, extracting a hidden pockets credential in an experiment that drew consideration to claims that synthetic intelligence was making critical safety flaws simpler to take advantage of.
Problem operator James Pavur confirmed the profitable assault, saying server logs supported the researcher’s findings.
Nonetheless, the outcome got here after issues with the problem’s preliminary configuration led safety consultants to query whether or not it meaningfully examined the underlying vulnerability.
The competitors adopted the October 21 disclosure of two important PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which researchers stated may enable attackers to execute code remotely on affected servers.
The discoveries prompted pressing warnings from cryptocurrency safety executives and emergency software program updates.
The Bitcoin problem then turned a public check of these warnings, and its obvious resistance to assaults fueled skepticism about how simply the vulnerabilities may very well be exploited.
Flawed Bitcoin problem falls inside hours of server modifications
Pavur initially configured the problem to serve atypical HTML by way of PHP’s built-in net server, limiting attackers’ potential to achieve the weak performance.
The setup drew criticism from cybersecurity researchers, who argued that its early survival supplied little proof of the issues’ exploitability.
Moral hacker and Hacktron co-founder Mohan “s1r1us” Pedhapati warned that the dialogue surrounding the competitors risked encouraging companies to underestimate the safety menace.
“This can be a very harmful narrative. Simply take a look at the engagement it is getting,” Pedhapati stated.
He argued that the problem was unrealistic in its early hours, when heavy visitors overwhelmed the single-threaded PHP server and made profitable exploitation unusually troublesome.
Pedhapati additionally cautioned that these issues didn’t show attackers with frontier AI fashions would wrestle to take advantage of the identical vulnerabilities below extra favorable circumstances.
He said:
“i do not suppose you are explicitly telling folks to not patch. however utilizing an unsolved, badly configured problem as proof that the vulnerability is overhyped may give folks false confidence and cause them to delay patching.”
Pavur subsequently acknowledged the configuration problem, confirming that he added an accessible PHP web page round 13:00 UTC on October 25.
The profitable assault adopted at 15:47:38 UTC, lower than three hours after the change.
The profitable researcher later printed a proof of idea on GitHub, describing the exploitation course of and a separate laboratory replica of the assault.
The account documented a profitable server response containing a Bitcoin non-public key, though the researcher acknowledged gaps within the preserved data from the unique try.
The printed proof additionally doesn’t set up that an autonomous AI system accomplished the assault or present a complete document of how fashions had been used throughout the profitable try.c
