PHP Attack Threatens Crypto Safety: Should You Cash Out or Pull Funds From Exchanges?

The FBI, NSA and CISA warned organizations to promptly fix two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can let unauthenticated attackers run malicious code on affected servers and carry a CVSS v4.0 score of 9.2. On October 21, 2026, the PHP Foundation released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Because PHP supports many websites and applications, the flaws may affect exchanges, wallet providers and DeFi platforms relying on vulnerable infrastructure, but they do not by themselves compromise Bitcoin, Ethereum or private keys held securely offline. Cloudflare reported attack traffic and deployed firewall protections, which do not replace patching.