# UK pentester ‘killa’ claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest

- URL: https://talkfuse.com/story/uk-pentester-killa-claims-2k-bitcoin-prize-in-php2shell-capture-the-flag-contest/
- Published: 2026-10-26T16:14:00+00:00
- Updated: 2026-10-26T16:20:37+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/security/2026/10/26/uk-pentester-killa-claims-2k-bitcoin-prize-in-php2shell-capture-the-flag-contest/5305429
- Topics: Business, Crypto, UK, World

## Key points

- Pentester Killa won $2,000 in Bitcoin.
- He gained remote code execution in about three hours.
- Experts say the result does not prove attacks can scale.

## Summary

UK-based developer and pentester Jaydip Modhwadia, known as “Killa”, won a $2,000 Bitcoin prize by exploiting a live website in a capture-the-flag challenge. His success showed that PHP2Shell can be used to gain remote code execution against a real target, while experts cautioned that this does not prove the attack can be automated at scale.

The challenge was launched by James Pavur on 24 October, initially with a $500 prize that the community later increased. Modhwadia said he found the flag in about three hours, although the site reported 19.28 hours; heavy traffic had made it difficult to use. His method used a single-file Python script requiring at most 20 HTTP requests and bypassed address space layout randomisation, but the challenge needed a PHP endpoint that was added after early participants reported it was missing.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.