PHP vulnerabilities CVE-2026-109618 and 109619 let hackers take over web servers. CZ warns crypto users. Here’s the risk to wallets and what to do.
Binance founder Changpeng “CZ” Zhao told his followers on Wednesday, October 21, to be “extra careful” visiting any website for the next few days. Why? PHP rushed out fixes for two PHP vulnerabilities that let attackers take over web servers without logging in. Plenty of sites won’t patch this week. Some never will.
The flaws, CVE-2026-109618 and CVE-2026-109619, have been nicknamed PHP2Shell. Each scores 9.2 out of 10 for severity, and the FBI’s Cyber Division told organizations that can’t update to take their systems offline. So what does a bug on someone else’s server mean for your crypto?
https://x.com/cz_binance/status/2113029289155178716
DISCOVER: Best Meme Coins to Buy in 2026
What Are the PHP Vulnerabilities, and Why Is Everyone Worried?
They let a stranger run their own code on a website’s server with a single request, before the site’s own software even loads. PHP’s release notice urged all users to update to version 8.5.12, 8.4.27, 8.3.36 or 8.2.35 immediately. Version 8.1 and older get no official fix.
The reach is huge. PHP runs 70.5% of the websites whose server language is known, W3Techs data shows. Sansec lists 11 apps where the attack has been confirmed, from WordPress and Magento to phpMyAdmin.
Attackers didn’t wait for the patch. Details leaked on October 20, a day before release, and Amazon’s honeypot logged an exploit attempt as early as October 17.
Security researcher Kevin Beaumont called it “one of the biggest vulns in years.”
https://x.com/FBICyberDiv/status/2112921648252719420
DISCOVER: Meme coin supercycle: Top performers this week
Why Is a Server Bug Dangerous for Crypto Users?
Because whoever controls the server controls the page you see. An attacker can slip a fake “connect wallet” button, or a drainer, a script that empties your wallet once you sign, onto a site you already trust.
It has happened before. In June 2025, hackers took over Cointelegraph’s front end and showed readers a fake airdrop pop-up. One of the new bugs can also leak a server’s memory, which may hold passwords, login sessions and API keys.
The big platforms say they’re clear. BNB Chain said its tech stack “does not use PHP,” and Trust Wallet said the same. That doesn’t cover the blogs, token pages and dashboards people click through on the way to them.
- Open exchanges and wallets from bookmarks, never from links.
- Read every wallet signature request before approving it.
- Turn on two-factor login and withdrawal-address allowlists.
- Keep long-term coins on a hardware wallet.
DISCOVER: Ethereum Foundation Partners With SEAL to Combat Wallet Drainers
Crypto Market Overview: Is the PHP Scare Hitting Prices?
Total Crypto Market Cap Coingecko
| Coin | Price | 24h change |
|---|---|---|
| Bitcoin (BTC) | $81,991 | −1.5% |
| Ethereum (ETH) | $2,409 | −1.6% |
| BNB (BNB) | $734.59 | −1.4% |
| XRP (XRP) | $1.33 | −1.5% |
| Solana (SOL) | $104.55 | −1.5% |
Not so far. The crypto market is worth $2.74 trillion, and the biggest coins are all down about 1.5% in 24 hours, a dip that tracks oil and the Iran headlines more than any hack.
Bitcoin holds 60% of the market, and the Crypto Fear & Greed Index reads 68, “Greed,” up from 63 a day earlier. No exchange or wallet has reported a loss tied to PHP2Shell yet.
The patches for both PHP vulnerabilities are out. The risk now sits with every admin who hasn’t installed them, and with anyone who visits their sites.
EXPLORE: Bitcoin Slides From $84,900 to $82,200 as Oil Jumps on Iran Strike Plans
