--- title: UK pentester 'killa' claims $2K Bitcoin prize in... description: UK pentester Jaydip Modhwadia, known as 'Killa', won a $2,000 Bitcoin prize in James Pavur's 'Steal My Bitcoin' capture-the-flag challenge by achieving remote... canonical: https://daily.dev/posts/uk-pentester-killa-claims-2k-bitcoin-prize-in-php2shell-capture-the-flag-contest-rhnd8wp6d twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: UK pentester 'killa' claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest | daily.dev og:description: UK pentester Jaydip Modhwadia, known as 'Killa', won a $2,000 Bitcoin prize in James Pavur's 'Steal My Bitcoin' capture-the-flag challenge by achieving remote... og:url: https://daily.dev/posts/uk-pentester-killa-claims-2k-bitcoin-prize-in-php2shell-capture-the-flag-contest-rhnd8wp6d og:image: https://api.daily.dev/og/posts/RhnD8Wp6D.png og:image:alt: UK pentester 'killa' claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # UK pentester 'killa' claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest **[The Register](https://daily.dev/sources/theregister)** · 4 min read · 0 upvotes · 0 comments ## Summary UK pentester Jaydip Modhwadia, known as 'Killa', won a $2,000 Bitcoin prize in James Pavur's 'Steal My Bitcoin' capture-the-flag challenge by achieving remote code execution via PHP2Shell. The site claims his Bitcoin was stolen after 19.28 hours, but Modhwadia says the actual exploit took around three hours. His published write-up describes a single-file Python script needing at most 20 HTTP requests. His method bypasses ASLR and other protections. Hudson Rock's Alon Gal said the feat doesn't mean autonomous AI agents can now compromise PHP servers at scale, calling it a sophisticated, target-specific exploit. Modhwadia donated part of the prize to the Lupus Foundation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is the PHP2Shell vulnerability actually exploitable in real-world conditions, or just a theoretical bug? It is exploitable in real-world conditions. UK pentester Jaydip Modhwadia demonstrated remote code execution against a live target by bypassing ASLR and other protections meant to stop RCE, achieving it in around three hours once a vulnerable PHP endpoint was exposed. His proof-of-concept Python script needs at most 20 HTTP requests to fully execute. _Teams patching PHP2Shell can track real-world exploit proof on daily.dev before assuming their mitigations hold._ ### Can AI agents now automatically hack any vulnerable PHP server using PHP2Shell at scale? No. Alon Gal, co-founder and CTO at Hudson Rock, said the successful exploit against a single target does not mean autonomous AI agents can compromise arbitrary PHP servers at scale, calling the proof-of-concept a sophisticated, target-specific exploit rather than an automatable attack. _Anyone assessing PHP2Shell's real blast radius can follow expert takes like this on daily.dev._ ## Similar posts on daily.dev - [Steal My Bitcoin](https://daily.dev/posts/steal-my-bitcoin-nbuzcqwqb) · Hacker News · 0 upvotes · 0 comments - [Steal My Bitcoin CTF PoC](https://daily.dev/posts/steal-my-bitcoin-ctf-poc-3uyn40xtx) · Hacker News · 1 upvotes · 0 comments --- Tags: [#php](https://daily.dev/tags/php), [#vulnerability](https://daily.dev/tags/vulnerability) [View this post on daily.dev](https://daily.dev/posts/uk-pentester-killa-claims-2k-bitcoin-prize-in-php2shell-capture-the-flag-contest-rhnd8wp6d) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"UK pentester 'killa' claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest","url":"https://daily.dev/posts/uk-pentester-killa-claims-2k-bitcoin-prize-in-php2shell-capture-the-flag-contest-rhnd8wp6d","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/uk-pentester-killa-claims-2k-bitcoin-prize-in-php2shell-capture-the-flag-contest-rhnd8wp6d"},"datePublished":"2026-10-26T16:14:48.438Z","dateModified":"2026-10-26T20:28:12.455Z","description":"UK pentester Jaydip Modhwadia, known as 'Killa', won a $2,000 Bitcoin prize in James Pavur's 'Steal My Bitcoin' capture-the-flag challenge by achieving remote...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b5af50cdd42bbb9bf0fb10bad4769aaa?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b5af50cdd42bbb9bf0fb10bad4769aaa?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/uk-pentester-killa-claims-2k-bitcoin-prize-in-php2shell-capture-the-flag-contest-rhnd8wp6d","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"php,vulnerability","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"UK pentester 'killa' claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/uk-pentester-killa-claims-2k-bitcoin-prize-in-php2shell-capture-the-flag-contest-rhnd8wp6d#faq","mainEntity":[{"@type":"Question","name":"Is the PHP2Shell vulnerability actually exploitable in real-world conditions, or just a theoretical bug?","acceptedAnswer":{"@type":"Answer","text":"It is exploitable in real-world conditions. UK pentester Jaydip Modhwadia demonstrated remote code execution against a live target by bypassing ASLR and other protections meant to stop RCE, achieving it in around three hours once a vulnerable PHP endpoint was exposed. His proof-of-concept Python script needs at most 20 HTTP requests to fully execute. Teams patching PHP2Shell can track real-world exploit proof on daily.dev before assuming their mitigations hold."}},{"@type":"Question","name":"Can AI agents now automatically hack any vulnerable PHP server using PHP2Shell at scale?","acceptedAnswer":{"@type":"Answer","text":"No. Alon Gal, co-founder and CTO at Hudson Rock, said the successful exploit against a single target does not mean autonomous AI agents can compromise arbitrary PHP servers at scale, calling the proof-of-concept a sophisticated, target-specific exploit rather than an automatable attack. Anyone assessing PHP2Shell's real blast radius can follow expert takes like this on daily.dev."}}]} ```