October 22, 2026

A hole in PHP has governments switching off their websites. What it means for your crypto

On October 21, the PHP developers shipped emergency fixes for two vulnerabilities dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619, severity 9.2 out of 10). They let an attacker run their own code on a website's server with no password and no account.

Most of the web runs on PHP: WordPress, Drupal, Joomla, Magento and thousands of custom-built services.

WHAT'S HAPPENING

Finland, the Netherlands, Canada and others have temporarily taken some government sites offline. The US NSA advises patching immediately — and, if that's not possible, taking the server offline. Cloudflare reports early attacks.

WHY IT MATTERS TO YOU

Your phone and wallet aren't directly hit by this flaw — it targets servers. The danger is different: a real site you know can start showing someone else's content. A "connect wallet" button, a login form or a payment address — swapped.

Be extra careful with small exchangers, shops and WordPress-based services: they are the slowest to update.

WHAT TO DO IN THE NEXT FEW DAYS

• Don't connect your wallet to sites unless you must, and don't sign anything you don't understand.
• Confirm payment addresses through a second channel — in the service's app or directly with the recipient.
• Check the address before you send: what kind of wallet it is and whether there's risk behind it.
• If you run a site: update PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. Updating WordPress does not update PHP — your host does that. There are no fixes for 8.1 and older.

No confirmed crypto thefts via PHP2Shell so far. The goal is to make sure you aren't the first.

Check an address before paying, for free: https://t.me/amlconsensus_bot?start=en