Crypto security chiefs sound alarm as PHP emergency patch scrambles devs worldwide

PHP released fixes on Oct. 21 for two critical vulnerabilities that can let unauthenticated attackers run code on web servers, as crypto security executives urged operators to patch and check overlooked infrastructure.

The PHP team's security advisory identifies CVE-2026-109618 and CVE-2026-109619, following its Oct. 20 advance warning. Both have a critical CVSS v4.0 severity score of 9.2 out of 10.

The fixes are available in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The project says all PHP installations serving web requests are at risk, with the highest risk in Apache's mod_php: a demonstrated exploit can run before application code begins.

CVE-2026-109618 involves unsafe cleanup after an out-of-memory error. CVE-2026-109619 involves stale internal state reused across requests.

The flaws are known as PHP2Shell. Cloudflare said it observed attack traffic targeting customers and attackers changing payloads to try to bypass its protections.

The threat has drawn warnings from senior security officials at Kraken and hardware wallet manufacturer Ledger, highlighting the risks that vulnerabilities in widely used software pose to cryptocurrency businesses and their supporting infrastructure.

The emergency coincides with separate security fixes for Node.js and the compromise of eight internet authentication certificates, putting pressure on operators to review the software and services that underpin their applications.

Kraken and Ledger warn of threats beyond vulnerable websites

Kraken Chief Security Officer Nick Percoco warned that organizations must act quickly to secure internet-facing PHP installations, citing Cloudflare's detection of emerging attacks.

Cloudflare Chief Technology Officer Dane Knecht said initial web application firewall rules were available on all plans, including Free. Cloudflare's subsequent advisory tells paid customers to confirm the managed ruleset is deployed in block mode.

Knecht described the protections as a stopgap. The PHP project says updating is the only complete solution; temporary measures reduce particular attack paths without making an installation safe.

Percoco urged administrators unable to patch immediately to take exposed systems offline or put them behind a web application firewall, with direct access to the origin blocked.

He also advised organizations to investigate their systems for unauthorized administrative accounts, modified PHP files and web shells after installing patches, since eliminating a vulnerability does not necessarily remove attackers who have already gained access.

The Kraken executive identified a more persistent risk in infrastructure that companies may overlook during emergency patching.

Routers, network-attached storage devices, firewalls, control panels and vendor appliances can contain embedded PHP components that depend on manufacturers for security updates.

Percoco warned that some devices depend on vendor firmware fixes and may never receive an update.

These risks extend to cryptocurrency exchanges, wallet providers and other digital asset businesses that rely on interconnected servers, administrative interfaces and third-party infrastructure.

The cited warnings do not report a breach of Kraken or Ledger.

The UK's National Cyber Security Centre urged organizations to identify PHP installations, prioritize internet-facing systems, apply updates and consider taking systems offline if temporary mitigations cannot be applied promptly.

The PHP security team also provided minimal source backports for PHP 7.4, 8.0 and 8.1. Those branches remain unsupported by the project. Operators using distribution or long-term-support packages should check their vendor for a backported fix or upgrade to a supported version.

Separate Node.js fixes and certificate updates

Separately, the Node.js project released versions 26.12.1, 24.22.1 and 22.23.4. The updates address high-severity flaws involving TLS certificate checks, DNS handling and a Brotli decoder bug that can permit remote code execution.

Node.js is widely used for application servers, API services and other backend infrastructure, including software that connects cryptocurrency applications to blockchain networks.

Ledger Chief Technology Officer Charles Guillemet highlighted the overlapping PHP, Node.js and internet authentication threats.

Guillemet also pointed to the compromise of eight intermediate certificates belonging to Indian digital trust provider eMudhra.

The certificates had exceptionally weak private keys, potentially allowing attackers to forge trusted website credentials and impersonate legitimate services.

Mozilla blocked the affected certificates through Firefox's OneCRL system on Oct. 17 and released additional browser updates. Cloudflare also deployed protections and released client updates.

The incident is particularly relevant to financial applications that depend on authenticated internet connections to communicate with exchanges, custodians and external service providers.

Cloudflare said the certificate compromise affected authentication rather than TLS encryption algorithms. Its security review had not identified active exploitation of this issue on Cloudflare services.

For certificate-dependent applications, Cloudflare advised updating the relevant trust stores and dependencies, rebuilding affected images and checking whether a restart or redeployment is needed.