Binance founder Changpeng “CZ” Zhao told his followers on Wednesday, October 21, to be “extra careful” visiting any website for the next few days. Why? PHP rushed out fixes for two PHP vulnerabilities that let attackers take over web servers without logging in. Plenty of sites won’t patch this week. Some never will.
The flaws, CVE-2026-109618 and CVE-2026-109619, have been nicknamed PHP2Shell. Each scores 9.2 out of 10 for severity, and the FBI’s Cyber Division told organizations that can’t update to take their systems offline. So what does a bug on someone else’s server mean for your crypto?
Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches.
Two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) reported for PHP, the web programming language, affecting servers…
— CZ 🔶 BNB (@cz_binance) October 21, 2026
DISCOVER: Best Meme Coins to Buy in 2026
What Are the PHP Vulnerabilities, and Why Is Everyone Worried?
They let a stranger run their own code on a website’s server with a single request, before the site’s own software even loads. PHP’s release notice urged all users to update to version 8.5.12, 8.4.27, 8.3.36 or 8.2.35 immediately. Version 8.1 and older get no official fix.
The reach is huge. PHP runs 70.5% of the websites whose server language is known, W3Techs data shows. Sansec lists 11 apps where the attack has been confirmed, from WordPress and Magento to phpMyAdmin.
Attackers didn’t wait for the patch. Details leaked on October 20, a day before release, and Amazon’s honeypot logged an exploit attempt as early as October 17.
Security researcher Kevin Beaumont called it “one of the biggest vulns in years.”
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially… pic.twitter.com/tnwiQv5v0F
— FBI Cyber Division (@FBICyberDiv) October 21, 2026
DISCOVER: Meme coin supercycle: Top performers this week
Why Is a Server Bug Dangerous for Crypto Users?
Because whoever controls the server controls the page you see. An attacker can slip a fake “connect wallet” button, or a drainer, a script that empties your wallet once you sign, onto a site you already trust.
It has happened before. In June 2025, hackers took over Cointelegraph’s front end and showed readers a fake airdrop pop-up. One of the new bugs can also leak a server’s memory, which may hold passwords, login sessions and API keys.
The big platforms say they’re clear. BNB Chain said its tech stack “does not use PHP,” and Trust Wallet said the same. That doesn’t cover the blogs, token pages and dashboards people click through on the way to them.
What to do this week:
- Open exchanges and wallets from bookmarks, never from links.
- Read every wallet signature request before approving it.
- Turn on two-factor login and withdrawal-address allowlists.
- Keep long-term coins on a hardware wallet.
DISCOVER: Ethereum Foundation Partners With SEAL to Combat Wallet Drainers
Crypto Market Overview: Is the PHP Scare Hitting Prices?
Total Crypto Market Cap Coingecko
| Coin | Price | 24h change |
|---|---|---|
| Bitcoin (BTC) | $81,991 | −1.5% |
| Ethereum (ETH) | $2,409 | −1.6% |
| BNB (BNB) | $734.59 | −1.4% |
| XRP (XRP) | $1.33 | −1.5% |
| Solana (SOL) | $104.55 | −1.5% |
Not so far. The crypto market is worth $2.74 trillion, and the biggest coins are all down about 1.5% in 24 hours, a dip that tracks oil and the Iran headlines more than any hack.
Bitcoin holds 60% of the market, and the Crypto Fear & Greed Index reads 68, “Greed,” up from 63 a day earlier. No exchange or wallet has reported a loss tied to PHP2Shell yet.
The patches for both PHP vulnerabilities are out. The risk now sits with every admin who hasn’t installed them, and with anyone who visits their sites.
EXPLORE: Bitcoin Slides From $84,900 to $82,200 as Oil Jumps on Iran Strike Plans
next
Disclaimer: Coinspeaker is committed to providing unbiased and transparent reporting. This article aims to deliver accurate and timely information but should not be taken as financial or investment advice. Since market conditions can change rapidly, we encourage you to verify information on your own and consult with a professional before making any decisions based on this content.
Daniel Frances is a technical writer and Web3 educator specializing in macroeconomics and DeFi mechanics. A crypto native since 2017, Daniel leverages his background in on-chain analytics to author evidence-based reports and deep-dive guides. He holds certifications from The Blockchain Council, and is dedicated to providing “information gain” that cuts through market hype to find real-world blockchain utility.