[Security Researcher Exploits PHP2Shell Vulnerability to Break Bounty Website, Claims Approximately $2,021 in Bitcoin Reward] According to Jinse Finance, on October 26th, security researcher killa (GitHub username KillaBoi) exploited the recently exposed high-risk PHP vulnerability PHP2Shell (CVE-2026-109618, CVE-2026-109619) to break the public bounty website stealmybitcoin[.]com, claiming 0.02511679 BTC, worth approximately $2,021 in Bitcoin. After the PHP remote code execution vulnerability was exposed on October 20th, and because publicly available reliable attack code was not yet available, someone set up the website on October 24th, deliberately using an unpatched version of PHP and offering a reward of approximately $500, inviting hackers to verify the vulnerability's exploitability. The reward later increased to approximately $2,000 due to donations. Approximately 19.5 hours after the challenge began, killa wrote usable attack code and obtained the server's private key, subsequently publishing the complete Proof-of-Concept (PoC) on GitHub. The website creator confirmed that the challenge had been solved and pointed out that he had made a mistake in placing the key.