The PHP Foundation has officially acknowledged internal structural failures that delayed the resolution of a critical security vulnerability since it was first detected in 2024. Deadlocks in the security team’s decision-making process and limited core developer resources stalled code fixes for two years. The situation only gained momentum after an external security firm proved the flaw could be exploited unconditionally.
The two recently patched critical vulnerabilities allow unauthenticated attackers to execute remote code (RCE). Through this flaw, attackers can take control of target servers without requiring credentials. Security firms Calif and OpenAI re-reported the issue on August 11, 2026. Calif’s report demonstrated unconditional RCE execution, immediately forcing developers to escalate the patch to emergency status.
The delay in releasing code fixes quickly drew scrutiny from the crypto industry, given that numerous digital financial services operate on open web infrastructure.
Why 793 Crypto Domains Are Now Under Scrutiny
Blockchain security firm SlowMist tracked the potential exposure through its MistEye system. Out of 1,488 crypto industry domains analyzed, SlowMist detected that 793 domains had direct traces of PHP usage. These findings prompted SlowMist to urge all crypto exchanges, DeFi protocols, and digital wallet providers to immediately audit their infrastructure and apply security patches.
Several blockchain projects moved quickly to limit access. Intersect, a member-based organization supporting Cardano blockchain development and governance, announced the temporary suspension of its Members Area page to assess the potential risk of exposure to the PHP flaw. This temporary shutdown was enacted while technical teams investigated the possible impact on their systems.
Other major digital asset infrastructure providers confirmed their systems were unaffected. Coinbase Chief Security Officer Jeff Lunglhofer stated that internal audits found no exposed PHP instances across the exchange’s infrastructure, while continuing to coordinate with third-party vendors. Echoing Coinbase, digital asset custody provider BitGo confirmed that all of its custody platforms and services remain safe from this vulnerability.
Government Services Also Shut Down
The impact of this delayed emergency patch extended beyond the crypto industry, spilling into the public sector across several nations. Multiple vital digital services in Europe were forced to shut down temporarily, ranging from the Dutch digital identity agency and Finnish government technology provider Valtori to the French Ministry of the Interior. Wikipedia backend services, namely Toolforge and Cloud VPS, were also temporarily taken offline.
In Australia, the Australian Signals Directorate (ASD) confirmed that its official website cyber.gov.au was affected by the flaw. In Tokyo, Japanese Prime Minister Sanae Takaichi intervened, calling on website operators via the X platform to prepare and deploy emergency patches immediately.
For users of crypto exchanges and decentralized services, this incident highlights that the security of digital assets is not solely determined by the reliability of smart contracts on the blockchain, but also by the robustness of the underlying web components supporting the system. The speed at which platform operators deploy updates is now critical before the flaw is exploited by external actors.
Sourced from Cointelegraph.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
