Crypto Firms Say They Don’t Use PHP After Critical PHP2Shell Flaw

Two critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have sent shockwaves through crypto and broader web security circles. Both carry a CVSS 9.2 severity rating. They enable unauthenticated remote code execution on servers running PHP. Exploitation attempts were recorded as early as October 21, 2026, before official patches even dropped. Binance co-founder Changpeng Zhao (CZ) has