Steal My Bitcoin offered a bitcoin bounty for extracting a private key from a deliberately vulnerable PHP installation. As of late Oct. 25, 2026, its wallet reportedly remained untouched after more than 17 hours online, with the prize near $2,000, or about 0.025 BTC. The rules allow attacks only on the web application and PHP container, not the underlying host or infrastructure.
The challenge advertises PHP 8.4.26, which is affected by two critical PHP2Shell flaws. One person who examined the site suspects its configuration may leave those flaws unreachable through the permitted attack surface. That theory is unverified: response behavior alone cannot establish the full server setup or prove exploitation impossible.
