Two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed PHP2Shell, have prompted crypto firms to clarify their technology stacks. Both flaws carry a CVSS severity rating of 9.2 and allow unauthenticated remote code execution on servers running PHP. Exploitation attempts were recorded as early as October 21, 2026, before official patches were released.
What the PHP2Shell Flaws Do
The bugs stem from use-after-free memory errors in PHP's core. CVE-2026-109618 targets the upload-progress unserializer and can leak passwords, session tokens, API keys, and even TLS private keys via a PHPSESSID cookie. CVE-2026-109619 exploits OPcache type confusion during fatal error backtraces. Both are triggered through standard multipart/form-data requests, a common format used in login forms, file uploads, and payment portals.
Ryan Austin of Calif discovered the first bug in August 2026, with Wiz Research and OpenAI reporting additional findings. Emergency patches covering PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 landed on October 21. Older PHP versions have no full official fix.
Risk in the Web Layer
For crypto, the risk is concentrated in the web layer. Smart contracts and cold wallets are untouched, but dApp frontends, KYC portals, exchange dashboards, and wallet-connect pages often run PHP-based stacks. A compromised frontend can inject wallet drainers or phishing flows, making funds disappear even when the underlying contracts are clean. Smaller exchanges with unpatched PHP portals face direct exposure, and the memory disclosure risk means stored API keys and credentials may need immediate rotation.
Security firm SlowMist (MistEye) has already scanned crypto industry PHP assets and is urging platforms to upgrade without delay.
Firms Reassure Markets
BNB Chain stated officially: "BNB Chain's tech stack does not use PHP. Our network and core infrastructure are unaffected by the PHP2Shell vulnerabilities." Trust Wallet echoed that stance, with staff member Felix Fan confirming the wallet has no PHP in its stack.
Binance co-founder Changpeng Zhao (CZ) went further on X, posting: "Call me paranoid, but be extra careful visiting ANY web site in the next few days." He flagged both CVEs and reminded followers to "Stay SAFU." His warning came amid reports of active exploitation already underway. Kraken is seen as lower-risk, as the exchange completed its core backend migration from PHP to Rust in 2025.
User Precautions
For users, security advice includes verifying URLs before signing transactions, avoiding unfamiliar wallet-connect prompts, enabling two-factor authentication, and using withdrawal address allowlists where available. The PHP2Shell flaw is a reminder that securing crypto means securing the whole stack, not just the chain.
