The PHP Shell Game: BNB Chain, Trust Wallet, and Kraken Clear Their Stacks

Two critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both carry a CVSS 9.2 severity rating and enable unauthenticated remote code execution on servers running PHP. Exploitation attempts were recorded as early as October 21, 2026, before official patches were released.

The flaws stem from use-after-free memory errors in PHP’s core. CVE-2026-109618 targets the upload-progress unserializer and can leak passwords on affected systems, while the broader PHP2Shell issue has raised security concerns across web infrastructure.

For cryptocurrency businesses, the risk is concentrated at the web layer, including dApp frontends, KYC portals, and exchange dashboards. Smart contracts and cold wallets remain unaffected by these particular vulnerabilities.

BNB Chain, Trust Wallet, and Kraken confirmed that their technology stacks are either PHP-free or have already migrated away from PHP. The exposure remains relevant to other crypto services operating PHP-based websites or applications. Binance co-founder Changpeng Zhao (CZ) urged users to be cautious about visiting any site.