Critical PHP vulnerabilities put hundreds of crypto services at risk

Traders Union
All News
Crypto
Critical PHP vulnerabilities

What threats were identified for cryptocurrency platforms?

Researchers at blockchain security company SlowMist examined 1,488 domains associated with the cryptocurrency industry. Of these, 793 showed signs of directly using PHP.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

Using PHP does not necessarily mean a service is vulnerable. However, platforms running affected software versions could potentially face attacks if administrators fail to install the updates.

Intersect, an organization involved in developing the Cardano ecosystem, temporarily disabled its Members Area to assess potential risks.

Coinbase said it had not identified any internet-facing PHP instances vulnerable to attack. The company also began additional security checks of third-party infrastructure providers.

Cryptocurrency custodian BitGo said its platform was unaffected. Meanwhile, Binance co-founder Changpeng Zhao urged users to exercise extra caution when visiting websites, as not all administrators had installed the security patches.

Developers acknowledge systemic failure

The PHP Foundation explained that efforts to fix the vulnerability had repeatedly stalled due to the complexity of the issue. The situation changed on August 11, when Calif and OpenAI independently reported the vulnerability, while Calif researchers demonstrated the possibility of remote code execution.

The organization described the delay as a "systemic failure" involving its decision-making processes and insufficient resources. However, at the time of public disclosure, PHP's security team had found no confirmed cases of exploitation.

Amid the security concerns, government agencies in the Netherlands, Finland, France, Germany and Australia temporarily took certain websites offline. The restrictions also affected some Wikipedia support services.

The risks associated with dependence on external infrastructure have previously affected the cryptocurrency market. In May 2026, Coinbase experienced an outage lasting more than two hours due to an Amazon Web Services disruption, affecting thousands of users.

At the time, the technical problems significantly reduced the availability of the exchange's services. Unlike the current PHP incident, the disruption was caused by a cloud infrastructure failure rather than a security vulnerability.

Earlier, we reported that OpenAI and Anthropic expanded their investigations into AI agent security failures. The companies are examining risks associated with autonomous systems and their interactions with digital infrastructure.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.