PHP2Shell Attack Exposes 553 lihi Emails as Websites Rush to Patch
A severe PHP2Shell vulnerability has triggered urgent security responses, with lihi founder Baker Cai reporting that attackers accessed 553 email addresses from the short-link service. Cai said no passwords, payment-card details or other personal information were taken, and the company’s operations remain unaffected. The addresses came from a membership database of more than 100,000 records; lihi is still checking how many belong to real users.
The PHP2Shell flaws, identified as CVE-2026-109618 and CVE-2026-109619, reportedly allow unauthenticated remote code execution and carry a severity score of 9.2 out of 10. PHP released patched versions on 21 October. Japan’s prime minister urged website operators to check their PHP systems, and a number of Japanese public and commercial websites temporarily shut down or restricted services for maintenance.
Taiwan’s cybersecurity authorities said about 28,000 publicly accessible local websites use PHP, including around 200 government sites. They advised operators to update PHP, use a web application firewall if they cannot patch, or temporarily take sites offline if neither option is possible. Authorities had not announced confirmed domestic victim cases at the time of the report. The PHP2Shell incident raises cybersecurity and operational risks for online businesses, but the article reports no direct effect on cryptocurrency markets.
Neutral
The incident is serious for affected websites and online businesses, but the article does not identify a direct link to cryptocurrency infrastructure, exchange operations, token fundamentals or blockchain activity. The reported lihi exposure was limited to 553 email addresses, with no passwords or payment data taken, and the company says its operations continue. As a result, the news is unlikely by itself to change crypto prices or market stability in a material way.
In the short term, traders may see increased attention to cybersecurity risk and operational resilience. If further disclosures revealed compromised crypto exchanges, wallet providers or major cloud infrastructure, market participants could react more sharply through risk reduction, higher volatility or withdrawals. No such crypto-sector impact is reported here.
Over the longer term, the attack may encourage businesses to patch software faster, strengthen web application firewalls and review vendor security. Similar broad vulnerability disclosures have often caused temporary concern, while sustained market effects have generally depended on evidence of financial losses, service outages or compromised crypto assets. Traders should therefore treat this as a general technology-security warning rather than a directional signal for crypto markets, while monitoring for follow-up disclosures.