A UK-based developer and pentester has claimed a $2,000 Bitcoin prize for demonstrating the exploitability of the PHP2Shell vulnerabilities that melted the internet last week. Jaydip Modhwadia, 26, otherwise known as “Killa,” claimed the prize set by James Pavur, who launched the "Steal My Bitcoin" site on October 24. Pavur launched the CTF (capture the flag) challenge to prove that the PHP2Shell exploit was not as easy as those in the cybersecurity community claimed it to be, promising to award $2,000 in Bitcoin to anyone who could achieve Remote Code Execution (RCE) on his website. "My Bitcoin was stolen after 19.28 hours," the website now says, after Modhwadia claimed the prize, although the real time taken is thought to be less than three hours. Soon after Pavur launched the CTF on Saturday, prospective flag-catchers complained that the website he set up, which served only static HTML, was not built in a way that allowed the PHP2Shell exploit to achieve RCE. The web page was running a vulnerable version of PHP, but the exploit path required a vulnerable website to serve a PHP file for flag-catchers to use as a hook – something that Pavur seemingly updated at around 1300 UTC on October 25. Modhwadia achieved RCE on the website, exposing a PHP endpoint, at 1547 UTC. After an error from Pavur placing the wrong wallet key on the server, the CTF creator sent Modhwadia his award, which the community upped to $2,000 from Pavur’s initial $500. The pentester published a write-up o...
UK pentester 'killa' claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest
The Register
·Published Oct 26, 2026
·Updated
Affected Software
1 affected component
PHP PHP
Frequently Asked Questions
1
Who claimed the prize, and what did they demonstrate?
Jaydip Modhwadia, a 26-year-old UK-based developer and pentester known as “Killa,” claimed the $2,000 Bitcoin prize. He demonstrated remote code execution on the challenge website.
2
Why did participants initially say the challenge could not be solved with the PHP2Shell exploit?
The site initially served only static HTML, despite running a vulnerable PHP version. Participants said the exploit required the vulnerable website to serve a PHP file that could be used as a hook.
3
Was the reported 19.28-hour completion time the actual exploit time?
The challenge site says the Bitcoin was stolen after 19.28 hours. However, the article says the actual time taken is thought to have been less than three hours.
4
What change appears to have made remote code execution possible?
Pavur seemingly updated the site at around 1300 UTC to address the missing PHP-file condition identified by prospective participants. The article does not specify the exact update.