Security researcher killa, known as KillaBoi on GitHub, collected a 0.02511679 BTC bounty from an intentionally vulnerable website, BlockBeats reported on October 26. The report valued the reward at about $2,000.
A public test of exploitability
The site launched on October 24 with unpatched PHP to test the practical exploitability of the recently disclosed PHP2Shell vulnerabilities. Donations increased its initial prize of about $500, according to the report.
BlockBeats said killa completed the challenge about 19.5 hours after launch by obtaining a server private key, and that the site’s creator subsequently acknowledged the challenge had been solved.
Source: BlockBeats, 2026-10-26 08:40:59 UTC.