On Wednesday, October 21, Binance founder Changpeng “CZ” Zhao advised his audience to exercise heightened caution when browsing any website over the following few days. This warning came as PHP hurried out patches for a pair of vulnerabilities that allow unauthorized attackers to gain control of web servers without requiring a login. Many websites will fail to apply these patches this week, and some will never do so at all.
Known collectively by the nickname PHP2Shell, the flaws are cataloged as CVE-2026-109618 and CVE-2026-109619. Each carries a severity score of 9.2 out of 10, prompting the FBI’s Cyber Division to advise organizations lacking the ability to update to take their systems offline immediately. For cryptocurrency holders, a security bug residing on a third-party server introduces distinct risks.
Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches.
Advertisement
Two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) reported for PHP, the web programming language, affecting servers…
What Are the PHP Vulnerabilities, and Why Is Everyone Worried?
These security gaps enable an outsider to execute custom code on a website’s server through a single request, even before the site’s native software initiates. Official PHP release notes instructed all users to upgrade immediately to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Version 8.1 and earlier iterations will receive no official patches.
The scope is extensive, as W3Techs statistics indicate that PHP underpins 70.5% of websites with a known server-side programming language. Furthermore, Sansec has identified 11 applications where successful attacks have been verified, ranging from WordPress and Magento to phpMyAdmin.
Malicious actors did not wait for official updates to be published. Technical specifics leaked on October 20—a day ahead of the software release—while an Amazon honeypot recorded an exploitation attempt as early as October 17.
Kevin Beaumont, a security researcher, described the issue as “one of the biggest vulns in years.”
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially… pic.twitter.com/tnwiQv5v0F
— FBI Cyber Division (@FBICyberDiv) October 21, 2026
DISCOVER: Meme coin supercycle: Top performers this week
Why Is a Server Bug Dangerous for Crypto Users?
Compromising a server grants an attacker control over the rendered webpage. Consequently, bad actors can inject fraudulent “connect wallet” prompts or deployment scripts—commonly called drainers, which empty a user’s wallet upon signature approval—onto sites that users already trust.
Precedents exist for this type of compromise. In June 2025, malicious actors hijacked the front end of Cointelegraph to display a fraudulent airdrop pop-up to visitors. Additionally, one of the newly uncovered flaws allows the extraction of server memory contents, which may expose sensitive credentials, active login sessions, and API keys.
Major platforms have stated their systems remain unaffected. Both BNB Chain and Trust Wallet confirmed that their respective technology stacks do not rely on PHP. Nonetheless, this does not shield the blogs, token information pages, and user dashboards that individuals navigate while interacting with those ecosystems.
Recommended safety precautions for the week include:
Accessing exchanges and crypto wallets strictly via saved bookmarks rather than external hyperlinks.
Carefully reviewing every transaction or wallet signature request prior to authorization.
Market impact has not been observed thus far. The total cryptocurrency capitalization stands at $2.74 trillion, with major digital assets dropping roughly 1.5% over a 24-hour window—a downward movement driven more by oil prices and geopolitical headlines concerning Iran than by any security exploit.
Bitcoin maintains a 60% market dominance, while the Crypto Fear & Greed Index registers at 68, indicating “Greed,” up from 63 the previous day. To date, no crypto exchange or wallet provider has reported financial losses linked to PHP2Shell.
Official patches for both PHP vulnerabilities are currently available. The remaining exposure rests entirely with website administrators who have yet to apply the updates and users who visit their unpatched platforms.
EXPLORE: Bitcoin Slides From $84,900 to $82,200 as Oil Jumps on Iran Strike Plans
