The FBI, the National Security Agency, and the Cybersecurity and Infrastructure Security Agency have urged organizations to patch two critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Known as PHP2Shell, the flaws carry a CVSS v4.0 score of 9.2 and could allow attackers to execute malicious code without authentication on vulnerable servers. The PHP Foundation released fixes on October 21, 2026, while Cloudflare blocked some attack traffic, but these measures do not replace patching affected systems. The vulnerabilities alone do not establish that cryptocurrencies, offline private keys, or exchange accounts have been compromised; holders should review official alerts, suspicious transactions, and possible credential exposure before deciding whether to withdraw funds or sell assets. Separately, Ledger’s investigation into a hardware implant linked to an estimated $93 million in losses across 311 wallets represents a supply-chain threat unrelated to PHP2Shell.
Source: Read the original article
