A critical server bug just got an emergency patch — and even CZ is telling crypto users to stay careful.
PHP shipped emergency fixes on October 21 for two remote-code-execution flaws dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), both rated 9.2 on the CVSS severity scale. Found by researchers at Wiz, Calif and OpenAI's Codex team, the bugs sit in the PHP runtime itself — a server running old PHP is exposed even if its own software is clean. Cloudflare is already seeing exploit attempts against customers, and researchers say AI tooling shrank the attack build from months to about a week.
Why it matters for crypto: the exposed categories are smaller exchanges, payment gateways and wallet web interfaces — a compromised front-end can swap deposit addresses or leak API keys. CZ and SlowMist have both urged platforms to patch. Nuance: no evidence any exchange has actually been breached, and blockchains, smart contracts and cold wallets are unaffected.
Have you seen your exchange publish a patch confirmation? That's the one signal worth waiting for this week. Not trading advice — security hygiene.
#CryptoNews #Cybersecurity #CryptoSecurity #PHP2Shell
PHP shipped emergency fixes on October 21 for two remote-code-execution flaws dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), both rated 9.2 on the CVSS severity scale. Found by researchers at Wiz, Calif and OpenAI's Codex team, the bugs sit in the PHP runtime itself — a server running old PHP is exposed even if its own software is clean. Cloudflare is already seeing exploit attempts against customers, and researchers say AI tooling shrank the attack build from months to about a week.
Why it matters for crypto: the exposed categories are smaller exchanges, payment gateways and wallet web interfaces — a compromised front-end can swap deposit addresses or leak API keys. CZ and SlowMist have both urged platforms to patch. Nuance: no evidence any exchange has actually been breached, and blockchains, smart contracts and cold wallets are unaffected.
Have you seen your exchange publish a patch confirmation? That's the one signal worth waiting for this week. Not trading advice — security hygiene.
#CryptoNews #Cybersecurity #CryptoSecurity #PHP2Shell