CZ warns crypto users as critical PHP flaws spark global patch rush

What happened

On October 22, Binance founder Changpeng Zhao issued a broad warning to cryptocurrency users and internet visitors generally, urging extra caution when visiting websites in the coming days. Zhao referenced two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which had been patched one day earlier after details leaked publicly ahead of schedule. The vulnerabilities affect PHP, a server-side programming language that powers approximately 69% of websites with known server-side code, according to reports.

The two flaws, collectively branded PHP2Shell by security researchers, allow attackers to execute arbitrary code on vulnerable servers without requiring authentication. PHP Foundation assigned both a severity score of 9.2 out of 10. The first vulnerability stems from memory corruption when PHP reaches its memory limit, while the second involves memory that remains accessible after being released. Either flaw could expose affected servers to remote code execution, sensitive data theft, and service disruption.

Details about the vulnerabilities began circulating online on October 20 with an incorrect severity score of 10.0. Security firm Calif mistakenly published a proof-of-concept video demonstrating attacks, while infrastructure firm Chainguard released patched software images more than six hours before the coordinated disclosure. These premature leaks prompted the PHP Foundation to accelerate its scheduled October 22 release to October 21, giving administrators minimal time to prepare patches before attackers could weaponize the flaws.

Why it matters

The scale and speed of exploitation underscored the severity. Cloudflare CEO Matthew Prince reported that before public disclosure, the company's network detected thousands of exploitation attempts. Within 45 minutes after announcement, that figure jumped to tens of thousands. Within two hours, hundreds of thousands of attempts were recorded, and by the time of reporting, millions of attacks were underway. This rapid escalation demonstrated how quickly attackers operationalize critical vulnerabilities in widely deployed software.

For cryptocurrency users and platforms, the threat operates through compromised web infrastructure rather than blockchain vulnerabilities directly. While smart contracts and cold wallets remain technically untouched, the web layer that manages user interactions becomes a critical attack surface. Compromised PHP-based frontends for decentralized applications, exchange dashboards, wallet-connect pages, and KYC portals could inject wallet drainers, phishing flows, or credential-stealing code. Security firm SlowMist identified 793 domains with PHP fingerprints among 1,488 cryptocurrency-related domains examined, highlighting exposure across the sector. The incident echoes previous infrastructure-level compromises that bypassed on-chain security entirely to drain user funds.

What the data shows

Patch releases arrived on October 21 across PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Older PHP versions outside the project's supported branches lack official fixes and depend on security updates from hosting providers or software vendors. Cloudflare deployed default firewall protections before public disclosure and worked with researchers from multiple organizations to prepare defenses, though the company emphasized that patching remains necessary alongside WAF protections. The FBI and cybersecurity agencies in the US, UK, and Japan urged organizations to install patches immediately or take affected systems offline until updates could be applied. Japan's Prime Minister Sanae Takaichi specifically urged website operators to apply fixes quickly.

Government response reflected the perceived threat level. The Netherlands took its digital identity service offline, while Finland, France, and Germany disabled several public websites as precautionary measures. Australia's cybersecurity website also went offline. The Wikimedia Foundation took support services offline, causing temporary disruption to Wikipedia. In cryptocurrency, platforms moved quickly with public confirmations of their infrastructure. BNB Chain stated that its technology stack does not use PHP and that its network and core infrastructure remain unaffected. Trust Wallet confirmed it has no PHP in its stack. Kraken was noted as lower-risk after completing its backend migration from PHP to Rust in 2025.

Background

The vulnerabilities stem from use-after-free memory errors in PHP's core. CVE-2026-109618 targets PHP's upload-progress unserializer and can leak passwords, session tokens, API keys, and even TLS private keys through a simple PHPSESSID cookie. CVE-2026-109619 exploits type confusion during fatal error backtraces in PHP's OPcache feature. Both vulnerabilities can be triggered through standard multipart form-data requests, the kind commonly used in login forms, file uploads, and payment processing, making them readily exploitable on most websites.

Ryan Austin of Calif discovered the first flaw in August 2026, with researchers from Wiz and OpenAI subsequently reporting additional findings. OpenAI stated that its models helped researchers identify the bugs as part of its Patch the Planet initiative, describing the vulnerability as one of the most impactful in recent memory. The PHP Foundation later acknowledged a structural failure in its own processes, noting it had first become aware of the problem in 2024 but lacked resources to prioritize it until Calif and OpenAI's reports elevated the urgency in August.

The affected platforms span the web ecosystem. WordPress, Magento, Drupal, and Joomla installations relying on vulnerable PHP versions faced exposure. However, the vulnerabilities affect server runtime layers, not website visitors directly. Visiting a PHP-based website does not automatically compromise a device or cryptocurrency wallet, though compromised servers could redirect users to phishing sites or inject malicious content into legitimate pages.

What to watch

The incident highlights the ongoing vulnerability of crypto infrastructure to web-layer threats, a pattern established by previous incidents including the Ledger hardware wallet exploit and Trust Wallet compromises. As reports from Crypto.news and other outlets have documented, phishing campaigns targeting cryptocurrency users continue to exploit infrastructure weaknesses. The PHP2Shell vulnerabilities demonstrate how quickly widely deployed software flaws can translate into large-scale attack campaigns, particularly when details leak prematurely. Administrators managing cryptocurrency payment systems, custodial services, or user-facing platforms should verify that all PHP installations have been updated to patched versions and monitor for signs of unauthorized access or compromised credentials. The PHP Foundation's acknowledgment of structural failures in its own disclosure processes may influence how the broader security community prioritizes rapid response to critical vulnerabilities in similarly foundational software.

Questions readers ask