Bitcoin hacking challenge finally falls as researcher proves critical PHP flaw is exploitable

A hacker breached a public PHP server to win a Bitcoin bounty after the challenge sparked doubts about critical software vulnerabilities.The researcher, identified online as Killa, successfully executed code on the Steal My Bitcoin challenge server on October 25, extracting a hidden wallet credential in an experiment that drew attention to claims that artificial intelligence was making serious security flaws easier to exploit.Challenge operator James Pavur confirmed the successful attack, saying server logs supported the researcher's findings.However, the result came after problems with the challenge's initial configuration led security experts to question whether it meaningfully tested the underlying vulnerability.The competition followed the October 21 disclosure of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which researchers said could allow attackers to execute code remotely on affected servers.The discoveries prompted urgent warnings from cryptocurrency security executives and emergency software updates.The Bitcoin challenge then became a public test of those warnings, and its apparent resistance to attacks fueled skepticism about how easily the vul...