Someone put a Bitcoin private key on a PHP server and dared the internet to take it. It lasted 19.28 hours.
The Steal My Bitcoin challenge ran unpatched PHP 8.4.26 with about $2,021 in the prize pot. On Oct. 25, KillaBoi got in through php2shell, a use-after-free in PHP's upload-progress code: blow the memory limit, read leaked addresses out of session cookies, then trick PHP's own cleanup into running system commands.
The twist, per the winner's writeup: the key that came out didn't match the prize wallet. A setup mistake on the organizer's side, acknowledged over email. The organizer's source repo also says the server setup was "heavily AI-assisted."
Fix is PHP 8.4.27, or switching off upload progress.
A hot wallet on a web server is a dare whether you post a prize or not.