During a major internet security crisis, the main participants in the Web3 market took coordinated action to communicate with investors. Today, the Trust Wallet cryptocurrency wallet team officially stated that their infrastructure is completely secure in the face of the critical PHP Shell vulnerability and its potential consequences, thereby dispelling growing speculation.
The day before, on October 21st, the Cybersecurity Department of the National Security Agency ( NSA Cyber ) of the United States issued an urgent warning to organizations that use PHP. Two serious vulnerabilities were discovered in the PHP core, namely CVE-2026-109618 and CVE-2026-109619. Attackers could remotely execute arbitrary code on the server without authentication ( unauthenticated RCE ).
A considerable portion of the traditional internet operates on PHP, including the WordPress platform and systems that use PHP-FPM. Millions of website resources are at risk as a result. PHP developers quickly released security patches, with versions including 8.5.12, 8.4.27, 8.3.36, and 8.2.35. However, this panic also affected the cryptocurrency industry, as users are highly sensitive to any infrastructure risks and are concerned that this crisis could have a chain reaction.
Developers say there's no need for panic.
To prevent the spread of rumors and to completely dispel speculation surrounding this vulnerability, Trust Wallet issued an official statement on X. In the post, the team directly stated that their applications and critical infrastructure are unrelated to PHP, and therefore this incident will not affect wallet customers in any way.
The company stated that since the technology stack of decentralized wallets is isolated from the architecture of PHP, this measure is a precautionary one. Previously, representatives of BNB Chain and the decentralized exchange PancakeSwap also issued similar statements, claiming that there is no PHP in their ecosystems.
Changpeng Zhao, the founder of Binance ( CZ ), also noticed this situation and published a series of posts. He emphasized that most projects should at least issue such confirmations, as remaining silent during global IT failures will only lead to the spread of false rumors and cause panic among users.
"No encryption wallet can be 100% secure. No software is bug-free. No technology can be 100% secure. Every action you take carries risks, and so does inaction. Problems, setbacks, and difficulties to be solved will always arise. Stay up-to-date, manage your risks, and solve them." —— CZ 🔶 BNB (@cz_binance) October 22, 2026
Currently, for cryptocurrency holders, the only potential threat may still be phishing attackers taking advantage of this vulnerability news to send malicious "security updates."
