Disclaimer: The opinions expressed by our writers are their own and do not represent the views of U.Today. The financial and market information provided on U.Today is intended for informational purposes only. U.Today is not liable for any financial losses incurred while trading cryptocurrencies. Conduct your own research by contacting financial experts before making any investment decisions. We believe that all content is accurate as of the date of publication, but certain offers mentioned may no longer be available.
The largest players in the Web3 market have conducted a coordinated campaign to inform investors amid a large-scale internet security crisis. Today, the team behind the Trust Wallet crypto wallet put an end to the growing speculation, officially declaring the complete security of its infrastructure in the face of the critical PHP Shell vulnerability and the potential consequences of this incident.
The day before, on October 21, the U.S. National Security Agency (NSA Cyber) issued an emergency warning for organizations using PHP. Two critical flaws were discovered in the core of the language, CVE-2026-109618 and CVE-2026-109619, allowing hackers to execute arbitrary code on a server remotely and without authentication (unauthenticated RCE).
You Might Also Like
HOT Stories
Since a significant part of the classic internet runs on PHP (including WordPress platforms and systems running PHP-FPM), millions of web resources were put at risk. PHP developers promptly released security patches (in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35), but the panic also affected the cryptocurrency sector, where users are sensitive to any infrastructure risks and to a possible echo of this crisis.
Developers say the panic is unwarranted
To stop the spread of rumors and completely eliminate speculation around the vulnerability (PHP exploit fallout), Trust Wallet published an official statement on X. In the post, the team directly stated that its applications and key infrastructure are not related to PHP, so the incident does not affect the wallet's clients in any way.
The technology stack of decentralized wallets is isolated from the PHP architecture, so the company's move was preventive. Earlier, similar statements about the absence of PHP in their ecosystems were issued by representatives of BNB Chain and the decentralized exchange PancakeSwap.
You Might Also Like
The situation was noted by Binance founder Changpeng Zhao (CZ), who published a series of posts. He emphasized that most projects should at least publish such confirmations, since silence during global IT outages only gives rise to false rumors and sows panic among users.
No crypto wallet is 100% safe. No software is bug free. No tech is 100% secure. There are risks in everything you do. There are risks if you don't do anything. There will be issues, setbacks and problems to solve. Stay up-to-date. Manage risks. Solve problems.
— CZ 🔶 BNB (@cz_binance) October 22, 2026
At the moment, the only threat to cryptocurrency holders remains the possible activation of phishers, who may use the news backdrop around the vulnerability to send out malicious "security updates."