The hacker KillaBoi won the Steal My Bitcoin challenge in just over 19 hours by exploiting two critical PHP vulnerabilities. The reward was worth 0.02511679 BTC, or about $2,021. His attack required around twenty HTTP requests and succeeded in seven out of ten test attempts, although it was tailored to the challenge’s specific configuration. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, received a severity score of 9.2 out of 10 and were fixed in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. In addition, a reconnaissance campaign targeted 216 potentially vulnerable servers, with its attribution to hackers linked to the Lazarus group remaining uncertain.
Source: Read the original article
Disclaimer: this content is for information purposes only and is not financial advice. Cryptocurrencies are highly volatile: you may lose all of your capital. Always do your own research. Legal notice
