PHP has released fixes for two critical vulnerabilities that can allow unauthenticated remote code execution, prompting the project to urge immediate updates and putting the web-server layer beneath crypto payment setups back on the operational agenda.
The PHP project’s October 21 advisory identifies the two flaws and lists fixed upstream releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The project strongly encourages affected users to update immediately.
Installations serving web requests are at risk, according to the advisory, which highlights the Apache mod_php configuration as particularly exposed. Distribution vendors may provide patched packages, so the applicable fix depends on how the software is supplied and maintained.
Why crypto merchants should check their stack
The connection to crypto commerce is practical. BTCPay Server’s official documentation explains how merchants can connect its payment system to WooCommerce, including arrangements involving an existing store or a deployed store environment.
A merchant using that combination has several components to maintain. The checkout website, its plugins, the hosting environment and the payment service have distinct responsibilities. Updating one component does not establish that every other part of the stack has been patched.
The PHP advisory concerns the runtime handling web requests. It is not evidence that Bitcoin’s protocol has been compromised, and it does not by itself identify a flaw in BTCPay Server’s core software.
Confirm the runtime is patched
The advisory provides a reason for administrators and hosting providers to check whether any connected storefront or service uses an affected PHP installation. The relevant confirmation is that the running environment contains the fix, rather than simply that an application plugin was updated.
The PHP team’s guidance is the authoritative starting point for remediation and version-specific details. Unsupported installations need particular attention to vendor support or migration to a maintained release.
No claim about stolen customer funds or a specific crypto company’s compromise is established by the advisory. The immediate news is the release of critical fixes for infrastructure that can sit underneath a crypto payment experience.
