26 • breaking absolutely everything • not really active on here, queries/press please contact below. contact: [email protected] or [email protected]

Leicester, United Kingdom
Joined December 2014
spot the odd one out @CounterStrike
5
37
40,425
killa retweeted
We are launching a PHP Capture the Flag challenge integrated with our Bug Bounty program to test our WAF protections. Security researchers are invited to bypass our defenses and capture the flag to help make the Internet safer. cfl.re/4iqHaQ1
14
49
16
326
42,730
killa retweeted
php2shell is one of the most impactful bugs in recent times, yet threat actors aren’t mass exploiting it the bug is so complex that even porting the exploit between targets takes serious skill, human or ai so i benchmarked how well open and frontier models can do it. 🧵
42
56
12
573
46,876
killa retweeted
Apple Watch, Pyongyang special version, by @i0n1c
61
129
26
1,514
102,544
JUST IN: Developer creates deliberately vulnerable PHP website, loads it with $2,021 in Bitcoin, & challenges the internet to hack it — site breached & Bitcoin drained in under 20 hours.
88
245
38
3,868
271,656
683
2,737
905
41,988
2,130,978
A developer left a PHP server vulnerable to the new PHP2Shell flaws and put a Bitcoin key on it, challenging hackers to steal the funds. After around 19 hours, a researcher known as KillaBoi successfully exploited the vulnerability and extracted the private key. The wallet contained around $2,000, but the key turned out to be linked to the wrong wallet, so the funds couldn’t actually be taken. The dev still confirmed the exploit worked and paid the researcher the prize.
32
116
3
2,981
156,721
‼️ A hacker cracked "Steal my Bitcoin", a server left on unpatched PHP to test the PHP2Shell flaws, in 19 hours. He published the exploit, which worked in 7 of his 10 lab runs. The key he took didn't open the $2,000 prize wallet. The creator had loaded the wrong one, he says. xitter.cf/jamespavur/status/2114…
❗️ A developer hid a Bitcoin key on a PHP server left unpatched against PHP2Shell, the critical flaws fixed on Oct 21, and dared anyone to steal it. 17 hours on, the wallet holds ~$2,000 and nobody has taken it. The developer says someone is crashing PHP but "still no RCE yet".
Readers added context they thought people might want to know
The GitHub repository cited as the source explicitly acknowledges in its README that the supposed exploit is fabricated: “And of course it’s fake. Duh. Note: No harm intended, purely for fun.” github.com/0x1c1101/CVE-2…
24
30
3
317
56,209
The way frontier labs have restricted access to cyber capabilities makes no sense. If you're considered a "defender" you're not allowed access to the "offensive" versions of the models (the ones that can do development/validation of malware and exploits). So for example, if you want to build some sample malware to test a detection system, nope. Or if there's a major crisis due to a critical vulnerability in PHP and you need to rapidly triage fake exploits to see if there are any real ones floating around so you can warn people, nope. Want to build a remote code exploit to make sure the detection rules you plan on proposing to the clients actually work? Hard nope. You gotta call your red team friend and wait for them to do your job for you, because "defender" are only allowed to play in the sandbox with the children. Not an expert, but I think that the ability to triage in-the-wild exploits during a major crisis affecting 40 million systems is possible maybe important. And then they want to ban abliterated open weight models, which half of the people are only using because frontier labs will only give them access to lobotomized models.
31
61
10
411
23,274
wtf
honestly insane if you read @killa GitHub report on how he did it also… there are some fees to claim on @Pumpfun for you 🫡
1
8
2
156
29,537
i guess i bought some, idk how any of this pumpfun works but thanks? also donated some of the btc and the pump fund stuff i got to the lupus research alliance cuz fuck lupus.
8
3
228
22,308
Someone has created a vulnerable PHP website, loaded it with a Bitcoin wallet, and challenged the Internet to hack into it and they can keep the Bitcoin. It has a running timer to show if the PHP exploitability was over-hyped. stealmybitcoin.com/
178
459
145
7,106
2,837,661
Replying to @JamesPavur @killa
Tested the POC on the server (which will be back online for people to play around with soon) and it works like a charm:
2
2
1
65
19,264
Congrats to @killa who solved stealmybitcoin.com hours ago but I screwed up which key went on the server (the flag was a root wallet WIF instead of the branch WIF). Check out their awesome writeup here: github.com/KillaBoi/StealMyB…
43
217
45
2,044
506,276
stealmybitcoin was just solved by @killa. Or rather solved a few hours ago. He was confused because the wallet address was wrong. Turns out the server didn't have the right wallet :P
I took a closer look at the stealmybitcoin.com CTF, which aims to demonstrate that PHP2SHELL is not realistically exploitable. So I gave it a try. Note: My analysis could be wrong, and I'm more than happy to be proven otherwise. Here’s what I found: • The server responds with Server: nginx and X-Powered-By: PHP/8.4.26. • My differential fingerprinting scanner independently confirmed at least PHP 8.2+ • Hypotheses: I considered two possible setups: ◦ nginx → PHP-FPM ◦ nginx → Apache → PHP-FPM/mod_php • After comparing the server's behavior against local test environments, the closest match appears to be nginx → PHP cli-server. Plot twist: the response behavior is consistent with the PHP cli-server serving a static index.html rather than an index.php. If that's indeed the case, the challenge appears to be intentionally made unexploitable. My conclusion (for now) is that I'm questioning whether this is a good-faith challenge. Happy to be corrected if I've missed something!
43
48
19
787
133,049
Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 Wed, keep disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected. #php #phpc
50
902
151
2,848
406,357
again
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
31
1,190
17
17,025
243,673
killa retweeted
PHP 8.5.12 released - 90 fixes in 29 components, including security fixes (CVE-2026-109618, CVE-2026-109619). Changelog + downloads: php-net.pro/news/php-8-5-12-…
42
2,497
214
5,381
722,935