PHP released emergency fixes on Oct. 21 for two critical vulnerabilities that can allow unauthenticated attackers to execute code on web servers, prompting warnings from security leaders at cryptocurrency firms. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, carry a CVSS v4.0 severity score of 9.2 out of 10. They affect PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, with the highest risk concentrated in Apache's mod_php module, where exploits can execute before application code begins. One flaw involves improper cleanup after an out-of-memory error, while the other reuses stale internal state across requests. Both are collectively referred to as PHP2Shell. Cloudflare observed attack traffic targeting customers and noted attackers attempting to modify payloads to bypass protections. Kraken Chief Security Officer Nick Percoco urged immediate action to secure internet-facing PHP installations, citing the need to block unauthorized administrative accounts and web shells even after patching. He also warned that infrastructure components like routers, firewalls and vendor appliances often contain embedded PHP dependencies that may lack timely updates, creating persistent risks for cryptocurrency exchanges and wallet providers. The UK's National Cyber Security Centre recommended prioritizing internet-exposed systems and considering temporary isolation for unpatched environments. Separately, Node.js released updates addressing high-severity flaws in TLS certificate validation, DNS handling and Brotli decoding that could enable remote code execution. The incident coincides with the revocation of eight eMudhra digital trust certificates due to weak private keys, which Mozilla blocked via Firefox's OneCRL system on Oct. 17. Cloudflare implemented protections and advised certificate-dependent applications to update trust stores and redeploy affected services. The PHP security team provided backports for unsupported versions 7.4, 8.0 and 8.1, though these remain outside active support. Vendors using long-term-support distributions were advised to verify backported fixes or upgrade to maintained releases.