Researcher extracts Bitcoin private key via PHP flaw in under 3 hours
- —The challenge tested two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619
- —The breach occurred on Oct. 25 at 15:47 UTC, under three hours after the config change
- —The attacker published reproduction code and results on GitHub
- —The roughly $2,000 Bitcoin prize was paid to the winner separately
Why it matters: The case shows PHP flaws can expose private keys, a critical risk for exchanges and custodial services.
Source: Blockmedia