Two critical PHP vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution on vulnerable servers, affecting popular apps like WordPress and Magento; severity was rated 9.2 (one post says 9.3) out of 10.
[1][2][3][4]← Week of Oct 18Oct 18 – Oct 24 UTC Every claim links to the posts behind it01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 8 posts on X 1 week
Narrative / Rank 03 / Week of Oct 18 – Oct 24
PHP's CVE-2026-109618 / CVE-2026-109619 flaws (dubbed PHP2Shell, rated 9.2) go from leak to in-the-wild exploitation in 48 hours — and crypto projects rush to post 'we don't use PHP'
Peak / day16tracked accounts
Peak dayWedOct 21 · busiest day in the panel
Rest of X / peak day137distinct accounts outside the panel
Cited claims15source links retained
Market—no token attached
Attention
Who was talking, day by day
Tracked paneldistinct tracked accounts / day
Rest of Xdistinct other accounts / day
What happened
Two critical vulnerabilities in PHP — the language behind a large share of the web, and the stack under WordPress and Magento — became the week's dominant crypto-adjacent story. Posts name them as CVE-2026-109618 and CVE-2026-109619, describe them as allowing unauthenticated remote code execution, and give severity ratings of 9.2 (and 9.3 in one post) out of 10; the pair is nicknamed PHP2Shell. Details began circulating around Oct 20, patches were released Oct 21 after details leaked early, and exploitation was reported in the wild soon after, with WAF protections and emergency patching following. Government sites in Finland, the Netherlands and France were taken offline as a precaution, including the Dutch national cyber security centre's own site, and Japan's government sites went into emergency maintenance. In crypto, @themerit0crat said XmrBazaar / AnonBazaar would be taken offline as a precaution, @icplegend1966 posted about Japan suspending Desktop Cloud services after unauthorised access affecting potentially 26,739 servers, and a string of projects issued 'we don't use PHP' reassurances: @GhosterDex (quoted by @zunem01), @nearlytrade (quoted by @wtfisdee), and posts from @nftrvn for $XFER, @z3ro_5um, @peplord for PulseChain, and @zerkerthegreek. @cz_binance's thread — amplified by @zerkerthegreek — told followers to be extra careful visiting any website in the following days. @bsvdrip amplified @coinbureau's 'Black October' framing. Some posts pushed beyond the facts: @xrp_seer advised holding nothing on exchanges and predicted a cyberattack on them, @alex_atoms cited an iOS exploit toolkit called DarkSword that can reportedly steal seed phrases via malicious web pages, and @litecointa mocked people being told to buy guns over a PHP bug. @ethereumsever said the flaw had been known for 22 years but was nearly impossible to exploit until AI found a route in two days, and cited Anthropic security chief Jason Clinton warning things will get worse for about 18 months. @kg13445545, holding 0.7 BTC on GMO Coin, said the PHP scare caused disruption at GMO Coin and Coincheck, that Coincheck looked normal when checked, and that the 0.7 BTC was fine.
Why it matters
The week's dominant crypto-native story was not a token or a protocol: it was a web-infrastructure scare that spilled directly into crypto venues, forcing exchanges, DEXes and darknet-adjacent marketplaces to publicly state whether their code touched PHP. For a crypto audience the practical takeaway was the same one the posts hammered: the attack surface that matters is not your wallet software but the websites and services your keys interact with, and several projects chose this week to publish 'no PHP here' statements as a trust signal.
Observed reaction
Panic-adjacent but mostly procedural: the loudest posts are status updates ('we don't use PHP', 'funds are safe', 'XmrBazaar offline as a precaution') rather than price or directional takes. A smaller, more alarmist strand uses the moment to argue for pulling funds off exchanges and into cold storage, and one post mocks that overreaction. No market data block was provided for this story.
Spread
Where it started and who carried it
- First seen
- Oct 18, 01:53 UTC by @icplegend1966
- Accounts
- 27 tracked · 24 elsewhere on X
- Communities
- general ct (11), bitcoin (5), perps trading (4), eth defi (2)
- Key accounts
- @polymarketjapan, @zerkerthegreek, @binji_x, @anzalabidi, @bsvdrip
Explainability
Evidence register
Patches were released on Oct 21, 2026 after details leaked early, exploitation was confirmed in the wild soon after, and emergency patching/WAF protections followed; details began circulating around Oct 20.
[1][2][3]Finland, the Netherlands and France took government websites offline as a precaution, including the Dutch national cyber security centre's own site; Japan's government sites went into emergency maintenance, and UK and Japanese authorities urged immediate patching or temporary shutdown.
[1][2][3][4]Japan suspended Desktop Cloud services following unauthorised access affecting potentially 26,739 servers, per @icplegend1966.
[1]@icplegend1966 also stated eight eMUDHRA certificate-authority private keys were generated with dangerously weak randomness.
[1]XmrBazaar / AnonBazaar will be taken offline as a precaution due to the critical PHP vulnerabilities.
[1][2]Multiple crypto projects posted that they do not use PHP and are unaffected: GhosterDex, Nearly (@nearlytrade), $XFER (@nftrvn), @z3ro_5um's team, PulseChain and @zerkerthegreek.
[1][2][3][4][5][6]@cz_binance, retweeted by @zerkerthegreek, told followers to be extra careful visiting any website in the following days because some web admins are not up to date with security patches.
[1]@coinbureau, retweeted by @bsvdrip, said PHP powers roughly 7 in 10 websites, that the two flaws are rated 9.2/10, and that governments, banks and major platforms had taken sites offline, with some calling it 'Black October'.
[1]@xrp_seer advised holding nothing on crypto exchanges right now and said this is the perfect time for them to wipe out retail with a cyberattack.
[1]@alex_atoms said DarkSword, an iOS exploit toolkit made easier to access after its code leaked, can reportedly steal files, messages, Keychain data and crypto wallets via malicious web pages.
[1]@litecointa mocked people telling others to buy guns because of a PHP bug.
[1]@ethereumsever said the flaw had been known for 22 years but was nearly impossible to exploit until AI found a route in two days, and quoted Anthropic security chief Jason Clinton warning things will get worse before they get better, with roughly 18 months to endure.
[1]@kg13445545, holding 0.7 BTC on GMO Coin, said the PHP scare caused disruption at GMO Coin and Coincheck, that Coincheck appeared normal when checked, and that the 0.7 BTC was safe.
[1]@ilblackdragon, retweeted by @wtfisdee, framed the moment as 'Security Armageddon', citing PHP-based systems like WordPress, malicious TLS certificates, node.js and LiteLLM, and argued uncensored models are becoming key to security defenses.
[1]Angles
- Timeline teardown: leak → Oct 20 details circulating → Oct 21 patch → in-the-wild exploitation within days.
- Crypto's 'we don't use PHP' wave as a case study in trust-signaling statements during an infrastructure scare.
- Why a language flaw, not a chain flaw, became the week's crypto security story — the attack surface is the websites your keys touch.
- Unverified claims to watch: DarkSword iOS toolkit, the 22-year dormancy claim, the Jason Clinton 18-month quote, and the exchange-attack speculation.
Formats in use
- CZ-style 'call me paranoid' security PSA
- 'Black October' doom-narrative thread
- Project compliance statement ('no PHP in our stack, your funds are safe')
- Precautionary shutdown notice (XmrBazaar)
- Counter-take mocking the panic
Risks
- CVE numbers (CVE-2026-109618 / CVE-2026-109619), the PHP2Shell nickname and the 9.2–9.3 severity ratings come from posts in this dataset, not from an advisory we can independently verify here.
- The '22 years known, AI found it in 2 days' claim (@ethereumsever) and the quoted Jason Clinton 18-month warning are claims by those accounts and are unverified in this dataset.
- DarkSword, the iOS exploit toolkit described by @alex_atoms, is presented as 'reportedly' capable of stealing seed phrases — treat as unverified.
- @xrp_seer's suggestion that exchanges could be attacked to wipe out retail is speculation, and his advice to hold nothing on exchanges is financial advice we do not endorse.
- The wave of identical 'no PHP here / funds are safe' posts from project accounts (@GhosterDex, @nearlytrade, $XFER, PulseChain, @zerkerthegreek) is a pattern consistent with coordinated brand-safety messaging; read them as marketing, not independent audit.
- Several of the highest-reach posts in this story are retweets of larger accounts (@cz_binance, @coinbureau, @ilblackdragon), so engagement reflects the original author's audience as much as the tracked account's.
Observed content
Most-engaged posts
RT @cz_binance: Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches. Two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) reported for PHP, the web programming language, affectOpen on X →
RT @coinbureau: The internet is going into a LOCKDOWN. Hundreds of millions of websites are potentially at risk from cyberattacks. Governments, banks and major platforms have already taken their websites OFFLINE. Many are already calling it “Black October.” At the centre of tOpen on X →
RT @ilblackdragon: We are at Security Armageddon now. A large part of internet is affect in some way today, lots of older software vulnerabilities are coming out and through those more software is getting exploited. PHP systems like Wordpress power a big part of content websiteOpen on X →
今 GMOコインに BTC 0.7 置いてあるけど 移動させるか検討中 いたずらに不安から行動する必要もないし そのまま放置することもおかしいし どうしたものかな 今回PHP騒動で バタバタしたのは GMOコインと コインチェックかな コインチェックはポスト流れてただけだけど 自分が確認した時は正常だった GMO コインチェックから移動させると ビットフライヤー ビットバンク SBIVC という事になるけど こちらもレンディング会社みたいに 3社 (厳密には2社) ということになるね GMOコインの0.7BTCは無事 😊Open on X →
RT @nearlytrade: Nearly does not use PHP anywhere. We reviewed our full infrastructure this morning and the platform is not affected.Open on X →
XmrBazaar / AnonBazaar will be taken offline as a precaution due to critical PHP vulnerabilities: https://t.co/pxFtfjROGPOpen on X →
🚨 A critical PHP vulnerability is causing chaos across the internet. Government websites are going offline. Major platforms are scrambling to patch their systems. The internet is falling apart. PulseChain unaffected.Open on X →
🚨 $ICP ♾🔥 EUROPEAN GOVERNMENT WEBSITES WENT OFFLINE AFTER CRITICAL PHP FLAWS RAISED THE RISK OF REMOTE CODE EXECUTION. Finland, the Netherlands and France took public services offline as a precaution, including the Dutch National Cyber Security Centre website. The reported vulOpen on X →
History