GoKawiilHacker claims $2,021 Bitcoin bounty by exploiting unpatched PHP server flaw
A hacker breached an intentionally vulnerable server running unpatched PHP software, claiming a Bitcoin bounty posted on the Steal My Bitcoin website. The prize, initially worth around $502, grew through donations to 0.02511679 BTC ($2,021.22) before being claimed at 15:47 UTC on October 25, about 19.28 hours after the challenge began. The creator, 'cloudlandsdev', set up the test to see if the recently disclosed CVE-2026-109618 and CVE-2026-109619 PHP vulnerabilities, patched on October 21, could actually be exploited in practice.
GoKawiil's interpretation of the reporting above, not reported fact.
The bounty's quick claim suggests that turning the newly disclosed PHP remote-code-execution flaws into a working exploit is more achievable than some may have assumed, which could prompt faster patching urgency among server operators. The creator's comment about 'panicking' indicates genuine uncertainty within the security community about how exploitable these vulnerabilities truly were. Public bug-bounty-style experiments like this one may become a more common way to crowdsource real-world validation of vulnerability severity.
- A hacker claimed a $2,021.22 Bitcoin bounty by exploiting unpatched PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619.
- The challenge was solved in roughly 19.28 hours, with the reward pot growing via community donations from about $502.
- Official patches for the critical PHP flaws were released on October 21, days before the successful exploit was claimed.
Source: tomshardware.com — Newton Gitonga, 2026-10-26
Published there as: “Bitcoin reward offered to anyone who could break into an unpatched server running PHP, hacker cracks site and claims bounty”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.