The PHP team released fixes for serious server vulnerabilities on October 21, 2026, but website administrators must install them; unpatched sites may remain exposed. CERT-EU warned that the flaws could let attackers run code on a server without logging in. Cloudflare’s chief executive reported millions of exploitation attempts on its network, and Amazon found an attempt dating to October 17.
Coinbase and Bitgo said they found no exposure, while Binance said it had completed safeguards and remediation. The excerpt reports no exploitation of crypto firms or loss of user funds, but says smaller services may be slow to patch. Separately, researchers found weak keys for eight eMudhra intermediate certificates; Lightning Labs urged users of its Bitcoin and Lightning Network software to update.
