# Researcher Wins About $2,000 Bitcoin (BTC) Bounty in PHP2Shell Challenge By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/40889 Published: 2026-10-26T09:16:58.000Z Updated: 2026-10-26T09:16:58.000Z Section: Technology > The site’s PHP endpoint was added on Oct. 25, and killa’s exploit succeeded less than three hours later. Security researcher killa won an approximately $2,000 Bitcoin (BTC) bounty after demonstrating that a PHP2Shell exploit worked against a deliberately vulnerable website, resolving a challenge launched Oct. 24. Site creator cloudlandsdev confirmed the solve and transferred the reward after the demonstration. The exploit retrieved a private key stored on the server, but cloudlandsdev had placed a key from the wrong wallet branch there, so it did not unlock the funded prize wallet. The site initially served static HTML. Its PHP endpoint, which the exploit required, was added around 9 a.m. ET (13:00 UTC) on Oct. 25. Killa’s successful run came at 11:47 a.m. ET (15:47 UTC) that day. The [challenge was still unresolved earlier on Oct. 25](). Killa, whose GitHub username is KillaBoi, later published a proof of concept and write-up that reproduce the attack in a local lab. ## Links in this article - [challenge was still unresolved earlier on Oct. 25](https://www.tokenpost.com/news/technology/40630)