Blockchain security company SlowMist has issued a critical security alert concerning cryptocurrency exchanges, decentralized finance (DeFi) platforms, and cryptocurrency wallet providers worldwide.
Why is the PHP Vulnerability Dangerous?
According to SlowMist, two critical security vulnerabilities, tracked by numbers CVE-2026-109618 and CVE-2026-109619, have been discovered in the PHP programming language, which is widely used in the infrastructure of websites and applications.
These vulnerabilities, under the right conditions, could allow attackers to remotely execute code on vulnerable servers without requiring authentication.
Following this warning, the PHP team released security updates on October 21st. However, the early leakage of the vulnerabilities shortened the time system administrators had to apply the updates. The European Union Cybersecurity Agency (ENISA) and other organizations urged organizations using PHP to urgently update their systems.
At this point, the PHP vulnerability has caused concern in the cryptocurrency sector. This vulnerability does not directly affect smart contracts or cold wallets, but it is stated that it could affect web-based environments such as dApp interfaces and exchanges.
Are Binance and BNB Chain Affected?
Binance and BNB Chain stated in their announcements that the network, its underlying infrastructure, and the exchange were not affected by the recently discovered PHP vulnerability.
BNB Chain stated that it was not affected by the PHP vulnerability because it does not use the PHP programming language in its technology stack.
Binance stated in its announcement: “Binance is committed to protecting our users and our platform. Following the disclosure of a PHP vulnerability, our security teams implemented proactive measures and completed necessary fixes before the official patch was released. We continue to monitor developments and strengthen our security measures to help keep our ecosystem safe.”
Decentralized exchange PancakeSwap also announced that its infrastructure does not use PHP and that user funds are secure. US-based Kraken also stated that it is secure after migrating its core backend to Rust. Trust Wallet (TWT) also announced that they do not use PHP.
Urgent Warning from CZ for Users!
Binance founder Changpeng Zhao (CZ) also commented on the issue and warned users. CZ urged users to be extra cautious when visiting websites over the next few days.
CZ emphasized that some website administrators might not apply security patches in a timely manner, urging users to exercise caution. He also requested that crypto projects provide clear information on whether or not their infrastructure uses PHP.
*This is not investment advice.
