A remote code execution flaw in PHP, which Amazon has named PHP2Shell, could let attackers run their own code on a server without logging in, according to CERT-EU advisory 2026-018 as reported by Bitcoin.com News. PHP's maintainers shipped fixes on October 21, but every site has to install them, and the US Cybersecurity and Infrastructure Security Agency issued an alert the same day advising organizations to take PHP-based systems offline until patched. The National Security Agency issued its own warning. Attacks started before the disclosure. Amazon traced an exploitation attempt to October 17, and Cloudflare chief executive Matthew Prince said his network saw thousands of attempts in the 10 hours before the announcement, a number that has since climbed into the millions. Crypto firms moved quickly to report their exposure. Coinbase and BitGo said they were unaffected, Binance said it put safeguards in place before the patch and has finished remediation, and PancakeSwap and Bitget Wallet said they do not run PHP. No crypto firm had reported an exploit or lost user funds at publication. Binance co-founder Changpeng Zhao still urged users to "be extra careful visiting ANY web site in the next few days," warning that compromised sites could become "vectors for credential theft or device exploits."