Security researcher James Pavur's stealmybitcoin.com challenge cracked in under 20 hours
The gist
Security researcher James Pavur's stealmybitcoin.com challenge was won in 19.28 hours for a 0.02511679 BTC prize.
The result tests whether the PHP2Shell flaw is exploitable outside a lab.
How it unfolded
- Oct 25, 2026 15:47 UTCThe challenge was won after 19.28 hours; the prize pot was 0.02511679 BTC ($2,021.22).
- Oct 25, 2026Winner KillaBoi published a writeup and a proof-of-concept on GitHub (KillaBoi/StealMyBitcoin-PoC).
- Oct 29, 2026tl;dr sec described the PoC as getting remote code execution on Alpine PHP 8.4.26 in a single standard-library Python file, succeeding in about seven of ten runs.