A public Steal My Bitcoin CTF proof of concept describes how stale state left in reused PHP workers after memory exhaustion can lead to information disclosure and command execution in a local lab. The author reports verified execution in seven of ten runs using a particular Alpine PHP 8.4.26 CLI-server configuration. Different builds or worker settings can fail, so this does not demonstrate universal reproduction across PHP servers. Gaps in the original challenge’s traffic evidence and a mismatch with the prize address also distinguish local validation from actually winning the advertised funds.