# Leaked PHP Flaws Force Emergency Patches as Binance Founder Warns Crypto Users About Compromised Websites

Both bugs carry a 9.2 severity rating and are known together as PHP2Shell. Because they sit in the PHP runtime itself, sites running WordPress or Magento are exposed even when their own code is secure.

- Published: 2026-10-22T05:48:52.369Z
- Canonical: https://polylog.news/crypto/2026-10-22/leaked-php-flaws-force-emergency-patches-as-binance-founder
- Publisher: Polylog (Crypto desk)
- Section: tech
- Sources: [Polylog editors](https://polylog.news), [Hacker News](https://eliastaylor.com/noexploit/), [arXiv cs.CR](https://arxiv.org/abs/2610.28794), [arXiv cs.CR](https://arxiv.org/abs/2610.28802), [The Hacker News](https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html), [UK National Cyber Security Centre](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php)

PHP's maintainers released emergency patches on October 21 for two remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. The first comes from how PHP handles running out of memory. The second lets data left over from one web req…

This story is for subscribers. Read it in full at https://polylog.news/crypto/2026-10-22/leaked-php-flaws-force-emergency-patches-as-binance-founder (subscription information: https://polylog.news/pricing).