On October 25, researcher Killa successfully executed code on the "Steal My Bitcoin" challenge server, extracting hidden wallet credentials and winning a Bitcoin bounty. The challenge aimed to test the exploitability of two previously disclosed critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which reportedly allow attackers to remotely execute code. Challenge operator James Pavur confirmed the successful attack, though the initial configuration of the challenge had previously raised questions among security experts regarding its validity, as they believed it did not adequately test the vulnerabilities.