php

The vulnerability bounty platform Immunefi's CEO Mitchell Amador warned that internet users still face the risk of cyberattacks triggered by PHP vulnerabilities, especially small websites that are slow to adopt emergency upgrades, which may take weeks to patch. He stated, "The vulnerability apocalypse" is coming as planned, where the cost of discovering vulnerabilities becomes cheap while the cost of fixing them remains high. He advised users to treat any websites they log into in the coming weeks as potentially compromised, avoid reusing passwords, exercise caution when connecting to encrypted wallets, and revoke token authorizations that are unrecognizable.Previously, the PHP Foundation admitted that it delayed fixing a critical security vulnerability first discovered in 2024 due to resource shortages. PHP developers released emergency patches for two critical vulnerabilities on the same day, but each website still needs to complete the upgrade on its own. Cloudflare CEO Matthew Prince stated that within 24 hours of the PHP vulnerability being publicly disclosed, the web recorded millions of exploitation attempts, with thousands of attempts even before the disclosure. According to W3Techs, PHP supports about 69% of websites with known server-side programming languages, and these vulnerabilities could allow attackers to spread malware or inject malicious scripts into websites.The FBI's Cyber Division also warned that these vulnerabilities could allow malicious actors to "remotely execute code in the PHP core, potentially compromising sensitive data and networks." Amador warned in an interview with Cointelegraph in June that the proliferation of cutting-edge AI models has changed the cybersecurity landscape, giving attackers an advantage, leading to the emergence of the "vulnerability apocalypse," and triggering a resurgence of DeFi hacking attacks. Immunefi is the world's largest vulnerability bounty platform, having paid out $140 million in bounties to 650 protocols to date.

A researcher successfully cracked the "Steal My Bitcoin" challenge using a PHP vulnerability.The prize for the challenge was 0.02511679 BTC. However, the challenge operators later discovered that the server had saved the wrong wallet key, and ultimately had to manually transfer the prize to the researcher.

Reuters reported on October 23 that Elizabeth Barron, the Executive Director of the non-profit organization PHP Foundation, which supports the open-source language PHP, stated in an email interview on Friday that the foundation is severely underfunded. She mentioned that recent events indicate a high reliance on PHP by businesses and governments, and given this reliance, PHP's funding is clearly insufficient.Barron noted that the foundation currently has only one full-time employee, which is herself, along with 14 part-time contractors, with funding coming from donations and grants. The increase in coding related to artificial intelligence has roughly doubled the foundation's workload. The number of code change proposals received by the PHP project is nearly double that of a year ago, but the number of contributors has not doubled. She stated that reviewing code contributions and bug reports requires a significant amount of manual input and expertise.Reuters reported that two serious vulnerabilities in PHP were discovered this week, prompting urgent patches for websites worldwide, highlighting the critical importance of this nearly thirty-year-old open-source language to the internet. The article stated that PHP may support approximately 70% of websites globally, and there is currently no evidence that these vulnerabilities were exploited before their disclosure. The report was filed by journalist Toby Sterling from Amsterdam.

The National Information Security Vulnerability Sharing Platform (CNVD) released a security announcement titled "Analysis and Repair Suggestions for PHP Remote Code Execution Vulnerability," in which it supports affected users to closely monitor official information, download and update to the latest version through official channels. Users who are temporarily unable to update can take measures to reduce certain attack vectors, mitigate vulnerability threats, and continuously monitor for abnormal PHP process exits, abnormal system command calls, unfamiliar process creations, and abnormal file writes, while retaining logs for traceability analysis.In its protection recommendations, CNVD stated that information system operating units should further strengthen security protection, comprehensively sort out their network assets, and reduce the public exposure of information systems according to the principle of not connecting to the internet unless necessary. Operating units that are currently unable to repair should take temporary response measures such as network isolation, network access restrictions, and taking unnecessary business systems offline.

The New York State Department of Financial Services in the United States has issued an alert regarding two critical PHP vulnerabilities, urging regulated entities to quickly identify and remediate known exploited vulnerabilities.

According to Bloomberg, Amazon's threat intelligence team discovered that hackers attempted to exploit related vulnerabilities days before the public disclosure of two security vulnerabilities in PHP. After the vulnerabilities were disclosed on Wednesday, hacker activities further expanded. Amazon stated that the related vulnerabilities are being widely exploited but did not disclose specific victim information.Cybersecurity company Palo Alto Networks found that there are over 22.6 million exposed instances worldwide with related vulnerabilities. Wiz researchers estimate that the vulnerabilities could affect about 70% of the internet and have existed for over a decade, while Matt Hull, Vice President of Cyber Intelligence and Response at NCC Group, warned that some vulnerable systems may have already been compromised or even implanted with backdoors.

The Cybersecurity Threat and Vulnerability Information Sharing Platform (NVDB) of the Ministry of Industry and Information Technology of China has detected two critical remote code execution vulnerabilities in PHP, posing serious risks. PHP is an open-source server-side scripting language widely used for web development. Unauthenticated attackers can exploit these vulnerabilities to execute arbitrary code remotely, leading to server control, sensitive information leakage, business interruption, and other harms.The affected versions include the 8.5 series below 8.5.12, the 8.4 series below 8.4.27, the 8.3 series below 8.3.36, the 8.2 series below 8.2.35, and the 8.1 series and earlier versions. The PHP security team has fixed the vulnerabilities and released a security announcement.NVDB recommends that relevant units and users conduct immediate inspections, upgrade to the latest secure version in a timely manner, or take temporary protective measures such as taking the system offline, disabling session upload progress features, network isolation, and restricting network access, as well as strengthening monitoring and management, and promptly modifying credentials such as accounts, passwords, and keys.

BTCPay Server has updated the optional WooCommerce/WordPress deployment through its Docker installer to address the recently disclosed serious PHP vulnerability. Users running WooCommerce on BTCPay Server should update immediately, which can be done by clicking "Update" directly within BTCPay Server.

Tencent Cloud Security Center has detected that PHP has been disclosed to have remote code execution vulnerabilities, with vulnerability IDs CVE-2026-109618 and CVE-2026-109619, codenamed "php2shell". This can allow unauthenticated remote attackers to trigger memory corruption and ultimately achieve remote code execution by sending specially crafted multipart POST requests, thereby completely controlling the server and causing other harms.Tencent Cloud Security recommends conducting timely security self-checks. If you are within the affected range, please update and patch promptly to avoid being invaded by external attackers.

According to GMGN data, the top 5 tokens with net inflow of smart money in the past 24 hours are as follows:PHP-UP (E1FT....smh): Net inflow of $1,000, with a 24-hour increase of 512.7%, currently priced at $0.0001.Pokémon (D42T....vb1): Net inflow of $1,000, with a 24-hour decrease of -38%, currently priced at $0.0007.XHOLDINGS (5SPg....ump): Net inflow of $699, with a 24-hour decrease of -18.8%, currently priced at $0.0001.Naseem (9PSZ....ump): Net inflow of $570, with a 24-hour increase of 37.1%, currently priced at $0.0001.XMR (WXMR....eJp): Net inflow of $544, with a 24-hour decrease of -3.2%, currently priced at $582.4483.

Slow Fog Security Warning states that PHP released a security announcement on October 20, disclosing two serious security vulnerabilities that could lead to remote code execution (RCE), numbered CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4 score of 9.2. Currently, the PHP official has not released a fix patch, and the specific affected versions and exploitation conditions are yet to be confirmed.According to existing information, the PHP official plans to release a security update on October 21 at 14:00 UTC (22:00 Beijing time). Slow Fog recommends that relevant institutions promptly check the PHP versions in their servers and business systems, focusing on PHP services exposed to the public network, and upgrade in a timely manner after the patch is released; systems that cannot be upgraded temporarily should restrict access sources and take isolation measures if necessary.

ChainCatcher news, several Philippine banks, including UnionBank, Rizal Commercial Banking, Cantilan Bank, and Rural Bank of Guinobatan, plan to launch a peso stablecoin named PHPX later this year, initially operating on the Hedera Distributed Ledger Technology (DLT) network.This project is initiated by the Singapore startup Just Finance, and the banks will play a significant governance role. Cross-border payments, especially remittances, are one of the key use cases for this project.

ChainCatcher live report, at the Solana 2024 Breakpoint conference, the CEO of the Philippine cryptocurrency exchange Coins.ph, Wei Zhou, announced the launch of the Philippine peso stablecoin PHPC on Solana.PHPC will go live on Solana in the next quarter and will introduce PHPC/USDT and PHPC/USDC liquidity pools to Solana.It is reported that Coins.ph is a leading crypto application in Southeast Asia, with over 16 million users, offering authorized fiat and cryptocurrency wallet and trading services, including cryptocurrency, e-wallets, and payments. The company is regulated by the Bangko Sentral ng Pilipinas (BSP) and holds a virtual currency and electronic money issuer license issued by the central bank.

ChainCatcher message, the stablecoin PHPC officially supported by the Central Bank of the Philippines is now live on the Ronin Network, with technical support provided by the Philippine crypto exchange Coins.ph.

ChainCatcher news, the Central Bank of the Philippines has approved a stablecoin called PHPC, which is pegged to the Philippine peso. This move aims to facilitate cost-effective remittances, supported by cash and cash equivalents from Philippine banks, and will initially be launched on the Coins.ph platform, with plans to expand to other platforms.It is understood that PHPC will be the first retail-focused stablecoin backed by the peso, offering real-time trading around the clock.