Flaws Allow Remote Code Execution on Vulnerable Servers

Two critical vulnerabilities have been identified in PHP, a widely adopted server-side scripting language. The issues, rated with a severity score of 9.2 out of 10 each, enable attackers to execute malicious code without authentication on affected installations.

The first flaw involves memory corruption during out-of-memory handling, while the second stems from internal data references that remain accessible after memory release. Both weaknesses can arise under specific configurations, particularly with Apache servers using mod_php or PHP-FPM.

Security researchers confirmed exploitation attempts following the disclosure. Although the vulnerabilities primarily impact website servers rather than visitor devices, compromised sites could allow content alterations or the insertion of fraudulent login pages.

Emergency Patches Released Within 24 Hours

The PHP development team moved its scheduled release forward and issued security updates on October 21, 2026. Fixed versions are now available for supported branches: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

Administrators running older unsupported versions must upgrade or obtain fixes from their hosting providers or software vendors. The official advisory states that temporary workarounds cannot eliminate the risk and recommends immediate patching.

Proven-of-concept demonstrations circulated online shortly after details leaked, prompting rapid responses from security firms. Cloudflare deployed Web Application Firewall protections before the vulnerabilities became public.

Agencies Urge Immediate Patching Across Sectors

National and supranational cybersecurity bodies have issued guidance for organizations to identify vulnerable PHP installations and apply the patches without delay. The Canadian Centre for Cyber Security, New Zealand’s National Cyber Security Centre, and the European Union Agency for Cybersecurity have all highlighted the risks.

While no cryptocurrency exchange breaches or user wallet losses have been linked to these specific flaws as of October 22, 2026, the issues affect a large portion of the web infrastructure supporting online services, including trading platforms.

Phishing campaigns targeting crypto users continue to evolve, and administrators with delayed updates could inadvertently create entry points for attackers.

Binance Enhances Platform Protections

Binance is actively monitoring the situation and has implemented additional safeguards to bolster its security posture. The exchange continues to strengthen defenses as part of its ongoing commitment to user protection.

Users are advised to bookmark legitimate sites and verify URLs directly rather than clicking links from third parties. Routine updates to web applications and server software remain essential for all organizations handling sensitive data.

The PHP team emphasized that updating is the sole complete solution for affected systems.