First screen, captured 12 hours ago. Hover to scroll the page, or open the video.

Steal My Bitcoin CTF PoC

What HN thinks

A bounty for hacking a website that, for most of its life, wasn't running the code you were meant to hack.

The challenge setup was unrealistic
It used PHP's built-in dev server behind nginx and served only static HTML for about 18 hours, so its duration and difficulty say little about real PHP sites.
The exploit was quick once PHP ran
Once a real .php file went live, it was broken within roughly two hours with LLM help, which backs the experts who called the vulnerability serious. Some see the doubters as being in denial, possibly for anti-AI reasons.
No swarms of insta-root bots
Others argue the exploit is fiddly and setup-dependent, so many unpatched servers probably weren't mass-compromised. Honeypot operators counter that attempts were widespread and successes began within days.

Consensus: Most agree the original setup was flawed and that the static-only period shouldn't count toward the challenge time. There's no agreement on how many real-world servers are now compromised.

Summarised by Claude from the comment thread 1 hour ago.

Points: 153
Comments: 43
Best rank: #14
Posted: 2026-10-26 by davikr

All captures:

Full page

Captured 12 hours ago. Click for the whole screenshot.

Looks similar

Screenshot of github.com: Parsing EDIFACT in Python with syntax trees

Parsing EDIFACT in Python with syntax trees (github.com)

19 points by alexprengere 4 days ago | 7 comments

GitHub repository for Edison, an MIT-licensed Python library from Amadeus that parses EDIFACT messages using syntax trees converted to state machines.

edifact python parsing syntax-trees

Screenshot of github.com: Show HN: Making a smart TV dumb and then smart

Show HN: Making a smart TV dumb and then smart (github.com)

69 points by animalhot 3 days ago | 38 comments

GitHub repo for r2d2-tv, a local home screen, private remote browser, and push-to-talk voice assistant that replaces vendor software on rooted LG webOS TVs.

webos smart-tv lg voice-assistant

Screenshot of github.com: PyTorch-native TPU back end for vLLM

PyTorch-native TPU back end for vLLM (github.com)

4 points by zniturah 6 days ago | 0 comments

GitHub repository for vllm-torchtpu, a PyTorch-native TPU backend for the vLLM LLM inference engine.

vllm tpu pytorch llm-inference

Screenshot of github.com: A train simulator game for console hackers

A train simulator game for console hackers (github.com)

8 points by avaraujo 6 days ago | 3 comments

GitHub repository for LeTrain, an open-source Java train simulator game playable in the terminal with ASCII graphics and vi keybindings, plus a libGDX graphical UI.

terminal-games java train-simulator ascii-game