Key facts
- Two critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, carry a CVSS 9.2 severity rating.
- The flaws enable unauthenticated remote code execution on servers running PHP.
- Exploitation attempts were recorded as early as October 21, 2026.
- BNB Chain and Trust Wallet stated their tech stacks do not use PHP.
- Kraken completed its core backend migration from PHP to Rust in 2025.
Two critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, with a CVSS 9.2 severity rating, enable unauthenticated remote code execution on servers running PHP. Exploitation attempts were recorded as early as October 21, 2026, before official patches were released. The bugs stem from use-after-free memory errors in PHP's core, allowing for the disclosure of sensitive information such as passwords, session tokens, API keys, and TLS private keys. These flaws are triggered through common multipart/form-data requests used in login forms, file uploads, and payment portals. Emergency patches were released on October 21, 2026, for several PHP versions, but older versions lack a full official fix. While smart contracts and cold wallets are unaffected, dApp frontends, KYC portals, and exchange dashboards running PHP-based stacks are at risk of being compromised to inject wallet drainers or phishing flows. Security firm SlowMist has scanned crypto industry PHP assets and urged platforms to upgrade. Major crypto firms like BNB Chain and Trust Wallet have stated their technology stacks do not use PHP, while Kraken completed its migration away from PHP in 2025. Binance co-founder Changpeng Zhao warned users to be cautious of web sites in the coming days.