A hacker has successfully breached a vulnerable server, claiming a prize pot worth $2,021.22 in Bitcoin after exploiting PHP2Shell vulnerabilities, a posting on the Steal My Bitcoin website has shown. The challenge's creator confirmed the win on October 25, ending an experiment designed to test claims that exploiting critical software vulnerabilities is becoming easier.

The challenge, hosted on the website a day earlier and announced through a forum post, initially offered approximately $502 worth of Bitcoin. Donations subsequently increased the pot to 0.02511679 BTC, worth $2,021.22 at the time of the win. The creator's website recorded the successful claim at 15:47 UTC on October 25, after the challenge had been running for approximately 19.28 hours.

The experiment follows the disclosure of CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities that can allow remote code execution under certain conditions. The flaws received critical severity ratings, and fixes were released on October 21. Turning the vulnerabilities into a reliable attack, however, requires more than simply running a publicly available exploit against an arbitrary server.

The challenge's creator, posting under the name ‘cloudlandsdev’, had said the project was designed to see whether anyone could use the vulnerabilities to compromise the server and claim its Bitcoin. “Made this because I'm curious if anyone out there has figured out how to actually use this PHP RCE, we spent the last few days panicking. Have fun!” the creator wrote.

PHP2Shell refers to two vulnerabilities in PHP’s request-handling and memory-management processes. Under vulnerable configurations, an attacker could potentially exploit these flaws to execute code with the privileges of the web server account.

The experiment quickly attracted attention, but the resulting traffic also became a problem. In an update, the creator said visitors were exhausting the server's available computing resources shortly after each capacity increase. Limited storage also prevented the server from retaining all its logs, complicating efforts to document a successful attempt.

The winner, ‘KillaBoi’, published a proof of concept on GitHub describing the attack against the live challenge and providing a local test environment. The exploit took advantage of PHP's handling of multipart uploads and session data, where, by pushing a PHP worker beyond its memory limit, the attacker could leave internal state in an inconsistent condition. Subsequent requests then exposed memory contents through session cookies, providing information about the locations of PHP's memory structures and executable code.

Notably, the attacker used those addresses to construct a forged PHP data structure that triggered command execution during cleanup. The final request returned evidence that the command had run inside the PHP process. Although the server was successfully compromised, the recovered private key did not match the advertised prize address. However, on-chain data shows the funds were subsequently sent to an address “bc1qr4…lk7a9”, labeled as a Kraken cold wallet.

Bitcoin recovery efforts have previously involved reverse-engineering software rather than exploiting a live server. In 2024, hardware hacker Joe Grand, known as ‘Kingpin”, and researcher Bruno recovered access to 43.6 BTC belonging to an owner identified as Michael, who had forgotten a 20-character wallet password.

The researchers reverse-engineered an older version of RoboForm's password generator and identified a flaw that made the password predictable. They recovered the wallet in November 2023, when the Bitcoin was worth approximately $1.6 million. Its value had climbed to nearly $3 million by the time the recovery was reported in May 2024.

A more recent case involved a Bitcoin holder who recovered five BTC worth roughly $400,000 in May 2026 after losing access to the wallet for years. The pseudonymous owner, known as ‘cprkrn’, said Anthropic's Claude AI helped identify a backup file from December 2019, which could be decrypted using a password the owner had previously written down in a notebook. The backup contained the keys needed to access the Bitcoin.

The latest event comes as security teams face pressure to patch PHP installations following the public disclosure of PHP2Shell. A separate report on the vulnerability disclosure controversy detailed how premature publication disrupted the coordinated release process. That said, for now, evidence of the latest successful attack suggests that exploiting these PHP vulnerabilities may not be that hard after all.

A developer using Claude Code to help build a temperature monitor app got a friendly warning from the coding agent. “Your Mac is running a crypto miner that I didn’t put there,” flagged the helpful agent. “I saw xmrig using about 1175% CPU, roughly 12 cores,” it informed its human master. Perhaps developer and Redditor UntilHEX should have sensed the crypto miner’s presence without AI help, as they admitted the malware’s presence “explains why my Mac has been running like s**t.”

Ironically, the cryptomining malware’s nefarious CPU cycle hogging activity is what may have led to its discovery and demise. Pondering over a screenshot of the Claude Code window, we see that this malware was probably added to the Mac’s startup roster on August 29. It looks like UntilHEX was inspired to develop a Mac temperature monitor app after this infection to track and diagnose why the computer was running so hot.

Claude stepped in after the Redditor was concerned about a dump of the Mac’s raw temperature sensor readings. “They seemed far too high,” commented UntilHEX in the social media post. Indeed, the well-known coding agent pointed out that the CPU was peaking at a very toasty 112 degrees Celsius. It explained this was due to a sustained heavy load, specifically “xmrig using about 1175% CPU, roughly 12 cores.” We don’t know how many cores the Mac being used had, but maybe 12 were all of them.

Claude Code went on to describe how the crypto miner software had hidden itself on the Apple computer and ran at startup. It cautiously decided not to kill or remove anything from the Mac, but offered to clean up the CPU-hogging crypto miner, which was sucking all the power from the Apple Silicon computer. “Can I clean it up now?” Claude inquired. “I’d stop the startup item and the miner, and move the files into a quarantine folder.”

Later in the comments, UntilHEX informed the social media throng that Claude was indeed tasked with cleaning up the unwanted crypto miner software. “I only had to delete 1 file manually because Claude had an access issue, but it was very effective,” the Redditor said. After that, a Malwarebytes scan was run to check to see if the AI coding agent-driven clean had really been successful.

An Nvidia-backed startup plans to establish a Bitcoin mining operation in space before the year is out. Starcloud will fire up its cryptocurrency mining ASICs after its second spacecraft reaches orbit later this year. “We’ll be the first to mine Bitcoin in space,” claimed Starcloud CEO Philip Johnston in a recent interview with Documenting Bitcoin.

Starcloud was founded in 2024 with the headlining goal of moving data centers to space. “As launch costs fall, data centers in space will leverage continuous solar energy and radiative cooling, rapidly scaling to gigawatts while avoiding permitting constraints on Earth,” reads its mission statement. The firm spells out its proposition in far greater detail in a white paper on its website, highlighting the appeal of training AI in space. However, the ample supply of solar energy is also great for cryptomining.

So, when Starcloud-2 reaches orbit, it will be tasked with raising some crypto-cash. In the embedded interview segment, Johnston said: “We’ll have some Bitcoin mining ASICs on the second spacecraft launching later this year.” At the time of writing 1BTC is worth roughly $86,000, quite a way down from highs several months ago.

Starcloud-2 is just the second of four currently planned satellite launches from the startup. It is framed as the company's first commercial mission, and like the prior satellite, will feature a GPU cluster. Interestingly, the official Starcloud-2 project page doesn’t mention Bitcoin mining or ASICs, so Johnston’s reveal is quite eyebrow-raising. Moreover, for something that seems a bit like an afterthought, “Potentially it [Bitcoin mining] is one of the most compelling use cases of space compute,” the Starcloud CEO told Documenting Bitcoin.

Johnson provided some financial insight into why there is now a Bitcoin side gig or pivot being considered. He cited the lower costs of ASICs vs. GPUs: they are about 30x cheaper than GPUs per kilowatt, he told the host. A specific example given was a 1KW Nvidia B200 chip at $30,000 vs. a 1KW ASIC at $1,000. Solving the energy supply situation in space for GPUs, or for ASICs, isn’t relevant to the business, said Johnson. We wonder what Nvidia will think about that.

While the availability of near-uninterrupted solar power is a big attraction of space-based compute, there are downsides. For example, satellites aren’t easy to service, and convection cooling doesn’t work in a vacuum. Commercial space-based data centers are so new that some of the problems and solutions will only become entirely clear after pioneering deployments like the Starcloud-2.

A project claimed to represent “the first organic neuron Bitcoin miner based on the fly brain” has gone live. Yes, this is a cryptomining project that leans on the fruit fly connectome recently shared by Google. FutureBit, the company behind the Apollo series of ASIC miners, introduced the world to its HashFly this week. However, HashFly is merely a proof of concept for now.

If you open the dedicated HashFly site, you can also participate in this agitation of fruit fly brains in the (vain) hope of a crypto payout. I clicked the 'Mine' button and left it running for an hour, for science, and periodically flipped back to the tab to see the gently rotating fly brain’s neuron traces firing. Looking at the website overlay, one can see the web app represents “2,914 traces firing” within the fly’s brain. It is worth mentioning that this figure is just a small subset of the full 165,122 reconstructed neurons in the MaleCNS v1.0 fruit fly connectome.

We understand that FutureBit’s HashFly focuses on the simulated photoreceptors that would usually sense light in the fly’s eye. These read a block header, and neurons called PPL101 cells light up when a double-SHA-256 target is computed. You can make the target harder and easier by adjusting the ‘zeros’ up and down. Even at maximum difficulty in this proof of concept (level 6), it is far, far easier than finding a real Bitcoin hash, and I saw about 80 blocks checked off in an hour or so.

What’s the point of this proof of concept? According to its designers, it provides some more insight into the potential efficiency of organic computing, or wetware. “Fun fact,” teases FutureBit. “If this could be scaled on real organic neurons, it would hash at ~ 1 watt per terahash... 10x the efficiency of the best silicon 3nm ASICs!” These guesstimates are based on “total power used by the fruit fly, and assuming all neurons could be used to hash Bitcoin functions and continually keep firing,” says the Bitcoin mining hardware maker in a follow-up tweet.

Those who find this experiment interesting may be happy to hear that the HashFly demo will be scaled up to its logical conclusion. “We are working on simulating all neurons in the dataset with the sha256 hash function and will publish all our findings,” says FutureBit. It certainly needs scaling up if my HashFly web performance of ~100 kH/s is typical. Compare that to the firm’s 5-inch cube Apollo III, which is claimed to deliver “up to 18 TH/s of Hashpower.”

We’ve seen a few other fly brain connectome mapping-inspired projects from the fevered minds active on social media over the last week or so. Almost immediately after Google announced it had published the complete brain and central nervous system of an adult male fruit fly, we saw people seeing if it could play Doom, indulge in financial day trading, and many more frivolous pursuits.

There’s even a rival cryptomining scheme dubbed the FlyMiner. Visiting this portal, you can see a fruit fly connectome that has been put under the control of an ASIC miner. Visiting that site will also be limited to a brain-nourishing, not money-spinning, activity, as FlyMiner admittedly has “almost zero chance” of mining success.

There is increasing evidence that Mexican drug cartels are diversifying into cryptocurrency mining and are using crypto platforms to diversify their income and, at the same time, launder their ill-gotten gains and fund other illegal activities. Reuters reports that local Mexican police uncovered a clandestine cryptocurrency farm in Tlaola, a town located in the leafy mountains of Puebla's Sierra Norte region. They found 300 GPUs, electricity infrastructure, and satellite equipment. The electricity-hungry operation likely drew power by secretly tapping into the grid at Presa de Necaxa, a nearby hydroelectric dam.

While this latest hidden facility found by police may seem small, Reuters notes it is the fourth such crypto farm Mexican authorities have uncovered in this region since early last year. According to a Mexico-based security analyst, the crypto farms discovered show that the cartels are increasingly sophisticated in their operations. In the latest bust, the Mexican federal authorities, the Navy, and state police seized around 300 GPUs, 80 medium-voltage terminations, a transformer, and eight satellite antennas.

It might not be surprising to hear about the Mexican cartels being tied up in crypto. Blockchain analytics firm Chainalysis, as cited by Reuters, reckons illicit crypto transactions grew from $59 billion in 2024 to $154 billion last year. The firm links the surge recorded to sanctions evasion involving governments. However, in South America, cartels are increasingly interested in using this channel to launder money. The mining operations are also integrated into the scheme, as stealing electricity is easy for organized crime. Mainstream consumer GPU mining ended in H2 2022, flooding the market with used graphics cards.

The source report doesn’t say how authorities found the crypto farm. Perhaps locals in this remote area of Puebla alerted authorities to the operation. Two folks from neighboring communities told Reuters that they could hear the crypto farm noise (transformers, cooling) from a kilometer away (0.6 miles), and the place was apparently a mere 2 km (1.2 miles) from the nearest village. The other three recently uncovered crypto farms were also near the same HEP dam, it is noted. Tlaola is a small community with around 20,000 inhabitants, so the noise levels and power consumption of crypto farms are very perceptible even if the cartels try to hide them deep in the mountains.

Remote communities, such as Tlaola, are popular locations for clandestine crypto farms because the electricity is cheap and most of them are under the protection of the cartels. For example, the Cartel Jalisco Nueva Generación (CJNG) and its armed branch, La Barredora, have the strongest presence in Puebla.

According to SILIKN, a Mexican cybersecurity firm, the use of cryptomining to launder illegal money rose by at least 55.8% last year in México. Drug cartels such as the Cartel de Sinaloa and the CJNG have set up crypto farms to mine Bitcoin (BTC), Monero (XMR), and Tether (USDT).

Similarly remote, illicit cryptomining facilities exist around the world, with Reuters recalling news of raids in Brazil, the U.S., and Thailand. Do you think there’s one near you? Please call the local police and liberate those stressed GPUs. Meanwhile, analysts expect crypto-related crime will reach new heights in the coming years.