The PHP project released fixes on October 21, 2026, for two critical vulnerabilities that can allow unauthenticated remote code execution. It urged affected users to update immediately. Installations serving web requests are at risk, particularly those using Apache mod_php.
The fixed upstream releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Distribution vendors may supply patched packages, so the applicable fix depends on how PHP is supplied and maintained. Crypto businesses should check any PHP-based storefront or service they run; updating a plugin alone does not confirm the running environment is fixed. The advisory does not establish a compromise of Bitcoin, BTCPay Server or any crypto company.
