PHP2Shell Raises Crypto Phishing Risks, No Losses Reported

| coinspeaker.com
Binance founder Changpeng Zhao (CZ) urged users to be cautious online after two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21. Known as PHP2Shell, the flaws each have a severity score of 9.2 and could let attackers run code on vulnerable servers without authentication. Attacks were reportedly observed after disclosure. PHP powers 70.5% of websites with a known server-side language, and affected applications include WordPress, Magento and phpMyAdmin. Administrators should update to patched PHP versions, monitor for suspicious command-shell activity and take affected systems offline if they cannot patch. PHP 8.1 and earlier have no official fix. Cloudflare said it enabled firewall protections before public disclosure. BNB Chain, PancakeSwap and Trust Wallet said their technology stacks do not use PHP, but compromised third-party websites could still expose crypto users to fake wallet-connection prompts, malicious signing requests or stolen credentials and API keys. No exchange or wallet losses linked to PHP2Shell have been reported. The vulnerability is a website-security risk, not a reported compromise of crypto networks or funds. Major cryptocurrencies were down about 1.5% over 24 hours, but the article attributed the move to oil prices and Iran-related headlines rather than PHP2Shell. Traders should use bookmarked links and carefully review wallet signatures.
Neutral
PHP2Shell creates a cybersecurity risk for websites, but no exchange, wallet or crypto network compromise or related losses have been reported. BNB Chain, PancakeSwap and Trust Wallet say their own technology stacks do not use PHP, limiting the direct connection to their tokens. The reported 1.5% decline in major cryptocurrencies was attributed to oil and Iran-related news, not the vulnerability. Short-term trading may see caution around wallet security and phishing, but there is no stated evidence of direct selling pressure on BNB or CAKE. Longer term, attacks on third-party sites could undermine confidence if they lead to user losses, while patching and security measures may contain the risk. On the available information, a material price impact on the mentioned crypto assets is not established.