A public bug-bounty-style challenge built around a real cryptocurrency prize has produced a fresh, working demonstration of two critical PHP vulnerabilities that were only patched a few days earlier. A researcher using the handle killa successfully exploited the flaws to reach a deliberately vulnerable test server, claimed the bounty, and has now published a proof-of-concept exploit publicly on GitHub.

A Bitcoin Wallet as the Prize

The challenge ran on a site called stealmybitcoin.com, which was deliberately configured to run an outdated, unpatched version of PHP and held a cryptocurrency wallet key behind a test specifically designed around remote code execution. In other words: whoever could get the server to run their commands could, in principle, walk away with the funds. The prize pool started at $500 and grew past $2,000 as the challenge attracted attention and donations while it was live.

According to the researcher’s own account, killa’s winning attempt took 19 hours and 17 minutes of effort and succeeded on October 25, 2026, at 15:47 UTC, claiming a payout of 0.02511679 BTC — worth roughly $2,021 at the time. The challenge’s creator later noted that early attempts against the server had failed for an unrelated reason: the site was initially serving static files through PHP’s command-line mode, which doesn’t trigger the vulnerable code path at all. Only after the configuration was switched to run through an actual PHP page did the exploit become viable, at which point killa’s chain succeeded.

The Flaws Behind the Challenge

The underlying issues are tracked as CVE-2026-109618 and CVE-2026-109619, collectively nicknamed the PHP2Shell flaws, and both carry a CVSS v4.0 score of 9.2 — solidly in critical territory. The first allows memory corruption during cleanup that follows an out-of-memory condition; the second allows data left behind by one request to be improperly reused by a completely different, later request when PHP is running in a shared-worker configuration. Chained together, the pair gives an attacker a path from a crafted request to code execution on the underlying server.

The PHP project shipped fixes for both issues on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Guidance from Google’s security team indicates the vulnerable range stretches all the way back through PHP 5.4, meaning a large population of older, unmaintained deployments could theoretically still be exposed. Critically, branches older than 8.2 — including the once-widely-used 8.1 line — no longer receive official security fixes at all, so administrators still running them have no vendor patch to apply and need to plan a version upgrade rather than wait for a backport.

Why a Second Wave of Attention Matters

This isn’t the first public demonstration tied to the PHP2Shell vulnerabilities — proof-of-concept code began circulating within days of the original disclosure, and security researchers had already observed attempts to weaponize it for automated botnet-style deployment against unpatched internet-facing servers. What makes killa’s challenge notable is that it provides an independently verified, cleanly documented exploitation path, built and tested specifically to prove real-world impact rather than simply to demonstrate the bug in a lab. A fresh, polished PoC landing on GitHub makes it considerably easier for both defenders to validate their own exposure and for less sophisticated attackers to replicate the attack against systems that still haven’t been patched.

What Organizations Should Do

With a patch available for five days now and multiple working exploits in circulation, security teams running PHP in production should treat this as an urgent patching priority if they haven’t already acted. Recommended steps include:

• Confirming which PHP version is running across all production and staging environments, including systems managed by third parties or embedded in appliances.
• Upgrading immediately to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on the branch in use.
• Planning an urgent migration off any PHP branch older than 8.2, since those versions will not receive an official fix for this or future vulnerabilities.
• Reviewing logs for signs of exploitation attempts, particularly unusual memory spikes or requests that resemble the shared-worker data-reuse pattern described in the advisory.

The episode is also a reminder of how quickly a patched vulnerability can turn into a public demonstration tool once a financial incentive — even a modest one — is attached to proving it works.