UK pentester ‘killa’ claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest
UK-based developer and pentester Jaydip Modhwadia, known as “Killa”, won a $2,000 Bitcoin prize by exploiting a live website in a capture-the-flag challenge. His success showed that PHP2Shell can be used to gain remote code execution against a real target, while experts cautioned that this does not prove the attack can be automated at scale.
The challenge was launched by James Pavur on 24 October, initially with a $500 prize that the community later increased. Modhwadia said he found the flag in about three hours, although the site reported 19.28 hours; heavy traffic had made it difficult to use. His method used a single-file Python script requiring at most 20 HTTP requests and bypassed address space layout randomisation, but the challenge needed a PHP endpoint that was added after early participants reported it was missing.
In short
- Pentester Killa won $2,000 in Bitcoin.
- He gained remote code execution in about three hours.
- Experts say the result does not prove attacks can scale.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The contest showed that PHP2Shell can enable remote code execution against a live website, and the winner’s relatively small script and request count suggest the technique may be practical for attackers when a suitable PHP endpoint is exposed. Publicly demonstrating the risk can help developers and security teams understand the threat and improve defences.
The case against
A successful capture-the-flag exploit demonstrates a vulnerability under the challenge’s specific conditions, not that attackers can automate it widely or succeed against typical websites. The target required a PHP endpoint that had to be added during the contest, and experts cautioned that the result does not establish attack-at-scale feasibility.
Explained simply
Capture the flag is a contest in which participants find a hidden code, or “flag”, by testing a computer system for weaknesses. A pentester is someone who checks systems for security flaws, usually with permission. In this challenge, organisers offered a cash prize for finding the flag on a live website.
PHP is a programming language used to build websites, and PHP2Shell is a way of exploiting certain weaknesses in PHP applications to run commands remotely. That can give an attacker control over parts of a server, which may put data and services at risk. The challenge drew attention to whether this kind of attack could work against a real target.
A successful challenge shows that the method worked in those conditions, but does not establish how often it would work on other sites or whether it could be automated at scale. The result also depended on the site having a PHP endpoint, a component that was added after participants reported it was missing.