On October 21, 2026, PHP shipped emergency releases fixing two critical flaws, CVE-2026-109618 and CVE-2026-109619, known in the security industry as "PHP2Shell". Both score 9.2 out of 10 under CVSS v4, and both can let an attacker run code on a server without logging in.

PHP is a common language behind websites. Many crypto platforms use it for their websites, account dashboards and APIs. The risk sits on those web servers, not on any blockchain.

What the two flaws are

  • CVE-2026-109618: when memory runs out, PHP can stop halfway through a request and leave half-built data that a later cleanup step still uses. A crafted upload request can trigger it.
  • CVE-2026-109619: PHP reuses the same worker for many requests. Memory freed at the end of one request can be used again by the next one (a "use-after-free").

The security firm Rapid7 says Apache mod_php setups carry the highest risk, because an attack can land before any application code runs. PHP-FPM setups are less exposed, but not fully safe.

Timeline

  • October 17: Amazon's threat intelligence team saw the first exploit attempt in its honeypot network, four days before public disclosure.
  • October 21: PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Public proof-of-concept exploits were already circulating earlier that day.
  • The same day, the US National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) urged immediate patching. CISA said it had not observed exploitation; NSA said attackers are likely to put the flaws to use.
  • October 22: the blockchain security firm SlowMist scanned 1,488 crypto industry domains and found PHP on 793 of them. SlowMist notes that running PHP does not mean a site is vulnerable or compromised.
  • October 23: PHP disclosed a related flaw, CVE-2026-115560, in its session upload progress feature. Cloudflare says it affects even the patched 8.5.12. PHP says only unusually configured sites are exposed and will fix it in the next routine release rather than in an emergency update.

Security firms disagree on whether any break-in has succeeded. Some report exploit attempts; Rapid7 says the public exploits only work on specific system combinations. So far no compromise of a crypto platform has been publicly confirmed.

What platforms should do

For now, do two things together: upgrade to the October 21 releases, and turn off session.upload_progress.enabled at the server level. The second step is also PHP's advice for the October 23 flaw until the next routine release. Rapid7 also suggests limiting upload request sizes. PHP 8.1 and older no longer get routine official updates and need an upgrade or a vendor patch.

What users can do

A server flaw has to be fixed by the platform; users cannot block it from their side. What users can do is keep their own accounts tight:

  • Turn on two-factor authentication (2FA), and do not rely on SMS alone.
  • If the platform offers a withdrawal address whitelist, add the addresses you use.
  • Be wary of messages that cite a "security upgrade" and ask you to log in again or enter a private key.
  • To find out whether a platform was affected, rely on its official announcements.