Crypto Firms Say They Don’t Use PHP After Critical PHP2Shell Flaw

HIGHLIGHTS Two critical PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619), both rated CVSS 9.2, enable unauthenticated remote code execution on PHP servers. The risk hits crypto at the web layer, dApp frontends, KYC portals, and exchange dashboards, while smart contracts and cold wallets stay untouched. CZ urged users to be cautious visiting any site, as BNB Chain, Trust Wallet, and Kraken confirmed their stacks are PHP-free or already migrated. Two critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have sent shockwaves through crypto and broader web security circles. Both carry a CVSS 9.2 severity rating.