AI agent solves 'Steal My Bitcoin' challenge, claims the full $2,000 bounty via PHP exploit

LurioNineFive · x · 2026-10-26

Per @thefusioncube, the AI agent @killa fully solved the "Steal My Bitcoin" challenge and claimed the $2,000 bounty using a PHP vulnerability, with a technical writeup published. The image outlines the exploit chain:

A small multipart upload makes PHP consume far more memory than the wire size suggests.
Running out of memory mid session upload-progress parsing leaves stale state in a reused worker.
Shaped follow-up requests leak bytes via session cookies, read as a heap address and a PHP code address.
With both addresses, a final request plants a forged PHP structure where cleanup will find it, triggering zifsystem, PHP's handler for system.
The command returns a fresh proof marker and a print-flag result over the still-open connection.

A landmark case of an AI agent executing a full memory-leak → forged-structure → RCE exploit chain on a real target.

Original post →