NewsPublished 30 Oct 2026

php2bitcoin x brotli2coin: live hacking stream

Source Reddit NetSec

Discussion

Brotli2Bitcoin is a purposely vulnerable web application exposed to the internet as a live hacking challenge with a $1,000 bitcoin bounty for achieving remote code execution (RCE). The challenge is streamed live, showing all attack attempts in real time. The scope is limited strictly to brotli2bitcoin.com, with authorized testing and rules to prevent denial of service or attacks outside the target. The first verified RCE that runs a specific command and reports the flag wins the bitcoin prize. This is a controlled security research exercise rather than an active threat or vulnerability disclosure.

r/netsec (opens in a new tab)u/eth0izzle0 points0 comments

I wanted to figure out just how exploitable php2shell and http2shell were in practice, so I've created two purposely vulnerable web apps: https://brotli2bitcoin.com & https://php2bitcoin.com with a standard production config -- pop an RCE and find the flag to claim the $1K BTC.

And to make it interesting, I setup a live stream showing every single attack attempt happening live https://www.youtube.com/watch?v=w7_EJWqRzvw

Good luck! ;)

Links cited in the discussion

Impact

There is no direct impact to users or systems beyond the controlled environment of the brotli2bitcoin.com challenge. The event does not represent an unpatched vulnerability or active exploitation in the wild. It is a sanctioned security research exercise with no reported compromise outside the scope of the challenge.

Defensive guidance

No mitigation is required as this is an authorized, controlled hacking challenge. The organizers have set rules to prevent denial of service and out-of-scope attacks. Participants should follow the rules and only test within the authorized scope. There is no indication of a vulnerability needing patching or remediation outside this context.

Summary

This event involves a live hacking stream targeting a deliberately vulnerable web application named brotli2bitcoin.com. The goal is to achieve remote code execution on the server to claim a bitcoin bounty. The organizers have authorized testing within defined rules and are streaming all attack attempts live. The challenge is designed to test exploitability of certain vulnerabilities in a controlled environment. No actual vulnerability details or exploits are disclosed, and the service is intended as a research and educational platform.

References

Community reviews

Loading reviews…

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 30 Oct 2026, 03:14 UTC

Technical details

References

Community reviews

Related threats