On October 21, PHP developers rushed to patch two security vulnerabilities in the language that powers around 70% of the world’s websites. Both flaws could allow attackers to execute code on a server without authentication. Both are considered critical vulnerabilities.
What Happened
The issue first came to light during a PHP security audit in 2024. At the time, researchers could not confirm that the vulnerability was exploitable, and efforts to develop a fix dragged on for months. The PHP Foundation later acknowledged that the team had taken too long to reach agreement on a fix and did not have enough people with the right expertise.
In August 2026, researchers at Calif found that the flaw could be exploited to run code on a server without authentication. OpenAI and Wiz independently reached the same conclusion. AI-powered tools assisted the research, but PHP developers prepared the fixes.
Read Also: Could AI Worms Become a Real Cyber Threat? Anthropic Weighs In
The patches were originally scheduled for release on October 22 to give website developers and software vendors time to prepare. However, on October 20, the vulnerability identifiers began circulating on social media and forums alongside an incorrect release date and an inflated severity rating. Calif later accidentally published a video demonstrating the attack. Although the video was taken down, copies quickly spread across the internet.
The situation became even more complicated when Chainguard, a company that provides hardened software builds, published PHP container images containing the fixes six hours before the official release. This gave attackers a chance to study the patches before updates became available to other users.
On October 21, PHP developers released four patches covering all supported versions of the language. All PHP versions released over roughly the past decade were affected, leaving almost the entire PHP-based web ecosystem potentially exposed. For websites that had not been updated in years, the team also released fixes for older versions that were no longer officially supported. Owners of sites running even older versions will have to migrate to a newer release, as no fixes will be available for them.
Don Smith of Sophos believes the main challenge now is identifying every vulnerable system. PHP may be running behind the scenes in content management systems (CMSs), hosting control panels, and third-party products, and organizations may not even know which systems are running it.
“The number of places where we need to look for vulnerable PHP versions is growing rapidly,” said John Hammond of Huntress.
Why This Matters to the Crypto Market
PHP vulnerabilities are not directly related to blockchains or smart contracts, but that does not mean crypto projects are immune to the risk. Exchanges, wallets, and other Web3 services rely on standard websites and servers, which may also run vulnerable software. If an attacker gains control of one of these servers, they could potentially access user data or disrupt the service, even if the blockchain itself continues to operate normally.
Shahak Shalev, head of fraud and AI research at Malwarebytes, points out that compromised websites that users trust can be used to spread phishing scams and distribute malicious files while posing as legitimate websites.
“This is a gold mine for hackers,” he warned.
Smart contract audits do not protect against security flaws elsewhere in the infrastructure. A vulnerability may lie not in a smart contract’s code but in the website users rely on to interact with it. That is why it is now important not only to install updates but also to check how crypto exchanges and other platforms are responding to the threat.
What Users Should Do
Users cannot fix a PHP vulnerability on someone else’s server. That is the responsibility of the website owner or hosting provider. In the meantime, while companies assess their infrastructure, users should take extra care to protect their accounts.
Binance founder Changpeng Zhao, better known as CZ, urged users to exercise caution online over the coming days. Not every administrator will manage to install the updates in time, and a compromised website could steal login credentials or infect a device.
“Stay SAFU,” he wrote.
Avoid clicking links to crypto services in suspicious messages. Check the website address before connecting your wallet, and never approve unfamiliar transactions. If an exchange or another service reports a security incident, follow its official guidance. However, the PHP vulnerability alone does not mean your account or wallet has been compromised. Any breach involving a specific service must be verified separately.
Our Take
This incident shows that a secure blockchain does not guarantee the security of the wider ecosystem. Web3 projects rely on the traditional internet, including ordinary websites and servers that can also contain critical vulnerabilities. The next threat may come not from smart contracts themselves but from the infrastructure that links them to the wider internet.
Crypto exchanges remain vulnerable even when their smart contracts have undergone security audits. What matters now is how exchanges and other Web3 projects respond to the threat. General advice telling users to be more careful is not enough. Companies need to take concrete steps to secure their infrastructure.
AI also helped researchers identify the vulnerabilities, according to OpenAI and Google. But releasing a patch is only the first step. Companies must update vulnerable systems on their servers and verify that the fixes have actually been applied. Perhaps this incident will ultimately lead to stronger cybersecurity and greater resilience to similar security threats.
