SlowMist Urges Crypto Platforms to Prepare for Critical PHP Fixes

PHP underpins most of the web, including public-facing pages run by brokers, exchanges and payment processors. The two flaws, CVE-2026-109618 and CVE-2026-109619, scored 9.2 for severity and let an attacker execute code on a server without logging in. Developers moved the fix release forward to October 21 after exploit details leaked ahead of schedule, turning a planned patch into an emergency one. Governments and security firms responded within hours, a measure of how central one scripting language still is to internet infrastructure.

Brokers and exchanges running PHP on public websites face a choice: patch immediately or take those pages offline, as the NSA advised. Client accounts and trading engines on separate systems stay reachable even if a marketing or payment page goes dark for hours. Smaller exchanges and crypto payment services without dedicated security teams carry the most risk, since they are least likely to patch within days. Operations teams now must audit every PHP-based layer, not just wallets, before reopening checkout pages.

The PHP Foundation's disclosure that a 2024 audit first flagged one of the two flaws, with a fix stalled for months, raises a harder question than this week's scramble: open-source code underpinning crypto payment flows can sit unpatched for years before anyone outside a small team notices. Cloudflare's count of exploit attempts jumping from thousands to millions after disclosure shows how fast attackers move once a flaw goes public. Crypto's dependence on ordinary web infrastructure, not just blockchains, is the uncomfortable part of this episode.

CZ's call for other projects to post their own PHP warnings, after BNB Chain and PancakeSwap already did on X, is the test of whether exchanges and infrastructure providers coordinate publicly or patch quietly and say nothing. How many platforms follow in the days after October 21, and whether any confirmed wallet or exchange compromise surfaces, will decide whether this becomes a footnote or a named industry incident.

BitcoinBTC market event: it is read against the reference

Bitcoin rose 0.7% in the 4 hours after the first headline, after rising 0.1% in the 2 hours before.

48 prices, one every 30 minutes