Bitcoin Bounty Falls in Under Three Hours After PHP Test Finally Gets Real

By Isaac • October 26, 2026 3:16 pm •

A public Bitcoin hacking challenge was finally breached after its operator changed the server so it actually exposed the vulnerable PHP functionality researchers had been warning about.

The sequence matters more than the bounty. Before the configuration change, the challenge was being treated as evidence that the underlying PHP flaws were overhyped; less than three hours after the server became a realistic target, that argument collapsed.

CryptoSlate reports that the Steal My Bitcoin challenge followed the October 21 disclosure of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which researchers warned could permit remote code execution on affected servers. Operator James Pavur initially served ordinary HTML through PHP’s built-in web server, a setup critics said did not