Severe PHP Vulnerabilities Discovered, Threatening Millions of Websites and Crypto Platforms

Recent findings by security researchers have unveiled severe vulnerabilities in PHP, the open-source scripting language that powers approximately 70% of the world's websites. These vulnerabilities, collectively referred to as PHP2Shell, are considered some of the most serious PHP flaws discovered in over a decade, drawing comparisons to the infamous Heartbleed incident.

The vulnerabilities were identified during an audit conducted by the security firm Calif in August 2026, utilizing OpenAI’s GPT-5.6 Sol model to analyze PHP’s code. The flaws allow for remote code execution, enabling attackers to execute unauthorized commands on servers, potentially exposing sensitive user data and serving as a gateway for further cyber attacks.

The urgency of the situation escalated when PHP developers released emergency patches on October 21, 2026, rated 9.2 out of 10 for severity. Cloudflare reported attempts by attackers to exploit these vulnerabilities against its customers, leading to precautionary shutdowns of several European government websites.

Crypto platforms, particularly those using PHP for payment processing, are at heightened risk. Vulnerabilities could allow hackers to access sensitive information, including passwords and authentication tokens, potentially compromising user accounts. Major players in the crypto space, such as Binance Pay and Crypto.com Pay, could be affected if their systems remain unpatched.

Experts advise all website operators, especially those in the cryptocurrency sector, to prioritize immediate updates to their systems. OpenAI has initiated a ‘Patch the Planet’ program, pledging $1 billion to support defenders in addressing these vulnerabilities. The situation underscores the critical need for robust security measures in an increasingly interconnected digital landscape.

As the situation develops, it remains crucial for users to verify the security status of their platforms and exercise caution when engaging with cryptocurrency transactions.