Skip to content
Critical PHP Vulnerabilities Threaten Crypto Security

Critical PHP Vulnerabilities Threaten Crypto Security

First seen 22 Oct 2026, 11:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 12:43 UTC
  • •Two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) allow remote code execution.
  • •PHP is widely used in crypto exchanges and DeFi platforms, increasing potential risk.
  • •Patches were released on October 21, 2026, and immediate updates are recommended.

The FBI, NSA, and CISA have issued urgent warnings regarding two critical PHP vulnerabilities, known as PHP2Shell, identified as CVE-2026-109618 and CVE-2026-109619. These vulnerabilities allow attackers to execute malicious code on vulnerable servers without authentication, posing risks to crypto exchanges, wallet providers, and DeFi platforms. Both vulnerabilities have a CVSS score of 9.2, indicating their critical nature. The PHP Foundation released patches for these vulnerabilities on October 21, 2026. Organizations using PHP are advised to implement these updates immediately to mitigate potential risks. Although the vulnerabilities could expose sensitive information, there is currently no evidence that any specific exchange has been compromised. The existence of these vulnerabilities raises questions about the safety of funds held in exchanges and whether users should withdraw their assets. Cybersecurity agencies are emphasizing the importance of patching affected systems promptly.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
Patches released for PHP vulnerabilities
The PHP Foundation released updates addressing the critical vulnerabilities CVE-2026-109618 and CVE-2026-109619.
Tradingview
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-22
FBI and NSA issue warnings
The FBI, NSA, and CISA warned organizations to patch critical PHP vulnerabilities that could allow unauthorized server access.
Tradingview

More articles in this cluster (2)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 3

Common questions

What are the CVSS scores for the vulnerabilities?
Both CVE-2026-109618 and CVE-2026-109619 have a CVSS score of 9.2, indicating critical severity.
What should organizations do to protect themselves?
Organizations using PHP should apply the patches released on October 21, 2026, to mitigate the vulnerabilities.
Is there evidence of exploitation in the wild?
Currently, there is no confirmed exploitation in the wild, but proof-of-concept code has been made public.