Crypto Firms Say They Don’t Use PHP After Critical PHP2Shell Flaw

Two critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have sent shockwaves through crypto and broader web security circles.

Both carry a CVSS 9.2 severity rating. They enable unauthenticated remote code execution on servers running PHP.

Exploitation attempts were recorded as early as October 21, 2026, before official patches even dropped.

Binance co-founder Changpeng Zhao (CZ) has since urged the crypto community to stay alert, a warning that has rattled investors and developers alike.

Ad

Ad

What the PHP2Shell Flaws Actually Do

The bugs stem from use-after-free memory errors in PHP’s core. CVE-2026-109618 targets the upload-progress unserializer.

It can leak passwords, session tokens, API keys, and even TLS private keys, all via a simple PHPSESSID cookie.

CVE-2026-109619 exploits OPcache type confusion during fatal error backtraces. Both flaws are triggered through standard multipart/form-data requests.

That is a very common request type across login forms, file uploads, and payment portals. Ryan Austin of Calif discovered the first bug in August 2026, with Wiz Research and OpenAI reporting additional findings.

Emergency patches, covering PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, landed on October 21. Older PHP versions have no full official fix.

For crypto specifically, the risk lives in the web layer. Smart contracts and cold wallets are untouched. But dApp frontends, KYC portals, exchange dashboards, and wallet-connect pages often run PHP-based stacks.

A compromised frontend can inject wallet drainers or phishing flows, making funds disappear even when the underlying contracts are clean.

This mirrors the dynamics behind recent wallet drains, where attack vectors bypassed on-chain security entirely.

Smaller exchanges with unpatched PHP portals face direct exposure. The memory disclosure risk also means stored API keys and credentials may need immediate rotation.

Security firm SlowMist (MistEye) has already scanned crypto industry PHP assets and is urging platforms to upgrade without delay.

Past incidents, including the Ledger hardware wallet exploit that saw an alleged $86M drain investigation, show how infrastructure-level gaps translate directly into capital loss.

Ad

Ad

BNB Chain, Trust Wallet, and CZ Move Quickly to Reassure Markets

Major crypto firms are wasting no time drawing distance from the flaw. BNB Chain stated officially: “BNB Chain’s tech stack does not use PHP. Our network and core infrastructure are unaffected by the PHP2Shell vulnerabilities.”

Trust Wallet echoed that stance, with staff member Felix Fan confirming the wallet has no PHP in its stack. These statements matter.

Frontend security failures have burned users before, including those caught in a Trust Wallet hack where BTC, ETH, and BNB were drained. Quick public clarifications now signal operational maturity.

CZ went further on X, posting: “Call me paranoid, but be extra careful visiting ANY web site in the next few days.” He flagged both CVEs and reminded followers to “Stay SAFU.”

His warning came amid reports of active exploitation already underway. Kraken, meanwhile, is seen as lower-risk, the exchange completed its core backend migration from PHP to Rust in 2025.

That kind of stack transparency is increasingly a competitive signal for institutional investors evaluating platform risk.

The incident also underscores a broader pattern of web-layer threats against crypto. Ledger responded to similar infrastructure pressure by launching an Android crypto device after a $93M hardware wallet hack.

Meanwhile, identity-layer solutions are gaining ground, Sam Altman’s World ID launched specifically to fight the AI-assisted fraud and phishing that PHP2Shell-style exploits tend to enable.

For users, it is important to verify URLs before signing transactions. Avoid unfamiliar wallet-connect prompts. Enable two-factor authentication and withdrawal address allowlists where available.

The PHP2Shell flaw is a reminder that securing crypto means securing the whole stack, not just the chain.