GoKawiilHacker claims $2,021 Bitcoin bounty by exploiting unpatched PHP server flaw
A hacker breached an intentionally vulnerable server running unpatched PHP software, claiming a Bitcoin bounty posted on the Steal My Bitcoin website. The prize, initially worth around $502, grew through donations to 0.02511679 BTC ($2,021.22) before being claimed at 15:47 UTC on October 25, about 19.28 hours after the challenge began. The creator, 'cloudlandsdev', set up the test to see if the recently disclosed CVE-2026-109618 and CVE-2026-109619 PHP vulnerabilities, patched on October 21, could actually be exploited in practice.