What Is a PHP Vulnerability? The Dangers and How to Fix It

After the emergency PHP patch was released on October 21, 2026, administrators of Finnish government sites, the BBC, and Edinburgh City Council chose to take their own sites offline. 

The cause is a PHP vulnerability called PHP2Shell, a security flaw that allows attackers to take over a server without a password. The danger of this PHP vulnerability also spreads to the world of crypto, especially through hijacked websites.

Key Takeaways

• PHP2Shell consists of two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, score 9.2 out of 10) that allow attackers to execute code on the server without logging in.
• PHP is estimated to power about 70 percent of websites, and an emergency patch has been released since October 21, 2026.
• For crypto users, the risk lies in hacked sites, not directly in wallets, and no confirmed loss of funds has occurred yet.

What Is a PHP Vulnerability and PHP2Shell?

PHP (Hypertext Preprocessor) is a server-side programming language. According to Metro TV, PHP supports many platforms, including online stores, Wikipedia, and WordPress. Every time a user opens a page on such a site, PHP is what gathers information and serves it.

PHP2Shell is the nickname for two PHP security flaws, namely CVE-2026-109618 and CVE-2026-109619. According to BeInCrypto, both score 9.2 out of 10 for severity. Both pave the way for remote code execution without authentication. This means attackers do not need an account or password to take control of an unpatched server.

The 70 percent figure is an estimate of PHP's share of the web, not the number of sites proven to be hackable. However, the scale is enough to make this critical PHP vulnerability be called one of the largest in recent times.

For users who want to transact on a licensed platform supervised by OJK, registration can be done at Bittime. Whatever the platform, access should be through the official app or a personal bookmark.

Timeline of the Discovery and Impact of the PHP Vulnerability

According to Forbes, security company Calif found this flaw with the help of an OpenAI AI model, while Wiz found it separately. The flaw had been hiding in PHP code for more than a decade, but had never been exploited. 

Metro TV reported that details of the finding had leaked online, forcing PHP developers to announce it immediately. The PHP Foundation then released a patch on Wednesday, October 21, 2026.

OpenAI called this finding one of the most impactful security issues in recent times. Wiz rated it among the most severe in PHP history.

The impact was immediate. Besides the Finnish government, the BBC, and Edinburgh City Council, Wikimedia disabled part of its systems as a precaution. Japanese Prime Minister Sanae Takaichi urged the public to check whether public sites use PHP, with advice to suspend sites temporarily if the patch cannot be installed.

Read Also: How to Buy NXPC (Nexpace) with Rupiah for Beginners

The Danger of the PHP Vulnerability for Crypto Users

According to Coingape, the risk to crypto is at the web layer, such as dApp frontends, KYC portals, exchange dashboards, and project sites. Smart contracts and cold wallets are not directly affected. However, a hijacked frontend could be injected with a wallet drainer or phishing flow, so funds can still be lost even if the contract is safe.

Several big players have said they are safe. CoinCodex reported that Binance, Coinbase, and Bitget said they were not affected. According to Coingape, Kraken, Trust Wallet, and BNB Chain also said they do not use PHP or have migrated. 

Crypto Economy noted that no regulated exchange or custody provider has reported losses due to PHP2Shell.

Still, caution is necessary. Binance founder Changpeng Zhao urged users to be careful when opening any site over the next few days, because not all admins install updates quickly. 

UNSW Sydney researcher Salil Kanhere also predicted that exploitation attempts will increase after technical details are published, including phishing messages riding on this news.

Read Also: World Oil Trust Fund: Note This Before Buying WOTF and How to Avoid Scams

How to Fix the PHP Vulnerability

For site owners or managers:

• Update PHP. According to AirdropAlert, the versions containing the fix are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP release notes state that there is no full mitigation, so updating is the only safe option.
• Migrate from older versions. PHP 8.1 and older are said not to receive the patch.
• Suspend temporarily. If updating is not yet possible, temporarily disabling the site is considered effective in reducing risk.

For ordinary users:

• Open crypto platforms via bookmarks or official apps.
• Ignore airdrop claim links or "account verification" from unknown messages.
• Check transaction details before approving, and enable withdrawal whitelists if available, as recommended by Crypto Economy.
• Follow advisories from affected services, such as requests to change passwords.

Conclusion

PHP2Shell is two critical PHP flaws that allow code execution without login, with potential impact on about 70 percent of websites. A patch is already available, but sites that are slow to update remain at risk. For crypto users, the main threat is hijacked sites and a wave of phishing, not direct wallet draining.

Check the price of Bitcoin (BTC), Ethereum (ETH), XRP, Solana (SOL), GRAM, and BNB as well as leading memecoin DOGE. You can trade directly on Bittime!

Bittime is a licensed Digital Financial Asset Trader (PAKD) platform supervised by the Financial Services Authority — where you can buy Bitcoin in Indonesia and hundreds of other crypto assets starting from IDR 10,000. The registration process is fast, secure, and can be started today.

Monitor the conversion USDT to IDR and the price movements of your favorite crypto assets in real time. Everything is available in one crypto investment app that you can download for free on the Play Store.

Ready to start? Register now on Bittime and execute your investment strategy with a platform trusted by millions of users in Indonesia.

FAQ

Why is PHP2Shell considered extremely dangerous?

Because attackers can execute code on the server without authentication, while PHP is so widely used.

Which PHP versions are already safe?

Versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 contain the fix. Users of PHP 8.1 and below need to migrate.

Can crypto wallets be drained directly through this flaw?

Not directly. Private keys are not stored on the PHP server. The risk arises if the accessed site is hijacked and then displays a fake interface.

Have real attacks already occurred?

According to Forbes, this flaw had never been exploited before it was discovered. After the details became public, experts expect attack attempts to increase.

Does AI make attacks like this easier?

Yes. Paul Spain of Gorilla Cyber Security said AI can speed up such attacks. OpenAI itself acknowledged that AI can help attackers craft exploits quickly.

Disclaimer: this article is for informational purposes and is not investment advice.