[Security Researcher Exploits PHP2Shell Vulnerability to Break Bounty Website, Claims Approximately $2,000 in Bitcoin Reward] BlockBeats reports that on October 26th, security researcher killa (GitHub username KillaBoi) successfully exploited the recently exposed high-risk PHP vulnerabilities PHP2Shell (CVE-2026-109618 and CVE-2026-109619) to break into the public bounty website stealmybitcoin[.]com, claiming a reward of approximately $2,021 in Bitcoin (0.02511679 BTC). It is reported that after the PHP core remote code execution vulnerability was exposed on October 20th, and because publicly available reliable attack code was not available for a long time, someone set up this website on October 24th, deliberately using an unpatched version of PHP, and posted approximately $500 in Bitcoin as a "bounty" to invite hackers to verify the actual exploitability of the vulnerability. The reward later increased to approximately $2,000 due to donations. Approximately 19.5 hours after the challenge began, killa wrote usable attack code and successfully obtained the private key from the server. The website creator later confirmed that the challenge had been solved, pointing out an error in his key placement, but admitted the attack was successful. Killa subsequently released the complete Proof of Concept (PoC) on GitHub.