Researcher Wins About $2,000 Bitcoin (BTC) Bounty in PHP2Shell Challenge

Security researcher killa won an approximately $2,000 Bitcoin (BTC) bounty after demonstrating that a PHP2Shell exploit worked against a deliberately vulnerable website, resolving a challenge launched Oct. 24.

Site creator cloudlandsdev confirmed the solve and transferred the reward after the demonstration. The exploit retrieved a private key stored on the server, but cloudlandsdev had placed a key from the wrong wallet branch there, so it did not unlock the funded prize wallet.

The site initially served static HTML. Its PHP endpoint, which the exploit required, was added around 9 a.m. ET (13:00 UTC) on Oct. 25. Killa’s successful run came at 11:47 a.m. ET (15:47 UTC) that day.

The challenge was still unresolved earlier on Oct. 25. Killa, whose GitHub username is KillaBoi, later published a proof of concept and write-up that reproduce the attack in a local lab.