Security Researcher Killa Extracts Bitcoin (BTC) Private Key From PHP Server in 2 Hours 47 Minutes

Killa Cracks the Steal My Bitcoin Server

A security researcher operating under the alias Killa breached a PHP server during the public “Steal My Bitcoin (BTC)” experiment and extracted a stored Bitcoin (BTC) private key, although the prize coins themselves never left their wallet. Bitcoin (BTC) price feeds showed an uneventful Monday, yet the exercise run by operator James Pavur produced the sharpest live demonstration so far that the two recently disclosed PHP flaws can end in a full server compromise and a leaked credential. Pavur confirmed the intrusion through the server's own logs after Killa achieved remote code execution late on Sunday, 2026-10-25, roughly two hours and 47 minutes after an accessible PHP page had been added to the target. The researcher then recovered the stored key from server responses and published a reproduction writeup on GitHub, documenting the path to the key and the results of rerunning the attack in a separate test environment. Killa acknowledged that not every request and response header from the live session was preserved, leaving parts of the attack chain undocumented. The headline outcome still favored the defense: the key sitting on the server was not the key controlling the prize address, so the experiment's Bitcoin (BTC) was never moved. Pavur accepted the result and paid Killa about $2,000 worth of BTC separately. A private key is the credential that authorizes spending on Bitcoin's proof-of-work network, meaning whoever holds it can move the coins with nothing more than a broadcast transaction. Pavur had staked real coins on the line to see whether the PHP vulnerabilities could be weaponized in practice, not merely described, and the server logs settled the question of whether the intrusion was genuine.

Two PHP CVEs and One Configuration Change

The flaws at the center of the test, CVE-2026-109618 and CVE-2026-109619, were disclosed on 2026-10-21, and both allow an outside attacker to run code remotely on an affected server without authentication. Remote code execution is the class of flaw that lets an external party issue commands on a machine, and the unauthenticated part means no login or user action is required. The experiment opened poorly for that thesis. Pavur initially served only plain HTML through PHP's built-in web server, a setup that left the vulnerable code paths effectively unreachable while a flood of connection requests destabilized the machine itself. Security researchers argued the configuration could neither prove nor dismiss the bugs' danger, and a competing narrative soon claimed the PHP risks had been exaggerated. Between the disclosure on 2026-10-21 and Sunday's breach, no participant had managed to reach the vulnerable code at all. Pavur responded by adding an accessible PHP page to the stack on Sunday. That single configuration change opened the attack surface, and Killa's exploit landed in under three hours. Mohan Pedhapati, co-founder of Hacktron, warned in the surrounding debate that rating the vulnerabilities as low risk because early attempts failed would be a mistake, since badly designed test results can be cited as grounds for delaying corporate security updates. Whether artificial intelligence contributed to the successful breach remains unconfirmed: the public record does not establish whether the exploit ran autonomously or with human direction. The stakes extend well beyond a contest server, because exchanges, wallet providers and custody operations keep precisely the kind of authentication material the flaws expose, and Killa's published reproduction gives defenders a concrete template for auditing their own stacks.

Custody Lessons Beyond the Prize

The result splits two risks that custody teams often blur together. Exposure of a stored key and control of the wallet that key belongs to are different failure states, and this test hit only the first. Products built on wrapped Bitcoin depend on the second, since a custodian's key controls coins users cannot recover themselves. The prize survived because the operator had stored the wrong key on the server, a defense that worked through configuration luck rather than design. The episode lands alongside the recent Electrum 4.8.3 wallet flaw as another reminder that the software stack around Bitcoin (BTC) remains a live attack surface.