Key Takeaways
- Coinbase and Bitgo reported no exposure to the PHP flaws, Binance “implemented proactive safeguards,” while some other crypto platforms said they do not use PHP.
- Cloudflare recorded millions of PHP flaw exploitation attempts, while Amazon detected an attempt dating to Oct. 17.
- Weak eMudhra certificates pose additional risks, prompting Lightning Labs to urge users to update their software.
“Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches,” Binance co-founder Changpeng Zhao (CZ) warned, adding that affected websites could become “vectors for credential theft or device exploits.” Binance itself said it “implemented proactive safeguards ahead of the official patch release and completed the necessary remediation.”
Update or Go Offline
PHP is a programming language used by about 70% of websites whose server-side language is known, according to W3Techs. CERT-EU warned that the vulnerabilities could allow attackers to execute their own code on a server without logging in. The PHP team released fixes on Oct. 21. However, each website administrator must install them, leaving unpatched sites potentially exposed.
“If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated,” the U.S. National Security Agency warned.
‘Millions’ of Exploitation Attempts
So far, only a few major crypto asset players have publicly addressed the issue. Some, including Pancakeswap and Bitget Wallet, said they do not use PHP, while Kaia Chain said PHP is not part of its core stack. Coinbase and Bitgo said they had found no exposure to the vulnerabilities.
“We’re also working with our third party suppliers for extra assurance,” Jeff Lunglhofer, chief security officer at Coinbase, said on X.
No exploitation of crypto firms or loss of user funds has been reported so far, but attackers are becoming increasingly active.
“In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now,” Matthew Prince, CEO of Cloudflare, a major cloud services provider, said.
Earlier Attack Attempts and Small Shop Problems
Even if a company patched the PHP vulnerability on Oct. 21, that does not mean attackers had not exploited it earlier. For example, Amazon found a PHP2Shell exploitation attempt dating to Oct. 17.
“But defenders should not assume the public disclosure date is the earliest date of exploitation,” Amazon Integrated Security chief information security officer CJ Moses warned.
Smaller crypto asset services, including merchants that accept bitcoin and other crypto assets, face a separate problem: They may apply patches late or not at all. While major firms have dedicated security teams, a small shop that accepts bitcoin (BTC) through a WordPress plugin may have to rely on its own resources or its web host to patch PHP. The popular open-source bitcoin payment processor BTCPay Server does not run on PHP itself, but its Woocommerce plugin for WordPress shops does.
The U.S. Cybersecurity and Infrastructure Security Agency has also advised organizations to take PHP-based systems offline until they can patch or update them.
eMudhra Problems and Lightning Labs Warning
Meanwhile, the bitcoin and crypto industry is dealing with another vulnerability linked to eMudhra, an Indian digital certificate authority. Researchers found that the private keys for eight of its intermediate certificates were extremely weak.
When a user visits a website over HTTPS, software checks its digital certificate to confirm the site’s identity. With one of these weak keys, an attacker could create a fake certificate for an exchange’s website.
Browsers have started blocking these certificates. However, other software, such as trading bots or apps with their own certificate lists, may not do so. Users should update their software to ensure it rejects the affected certificates.
Olaoluwa Osuntokun, chief technology officer at Lightning Labs, urged users of its Bitcoin and Lightning Network software to update immediately after the eMudhra vulnerability was discovered.
Stay Vigilant
Although users cannot patch the servers of the websites they visit, they can take precautions. They should use bookmarked official websites and ignore “urgent update” messages. As always, it is especially important to double-check where their bitcoin or other crypto assets are being sent. A hardware wallet displays the address to which funds are being sent, but it cannot tell whether a hacked website showed the wrong one. Users should confirm receiving addresses through a second source, such as the exchange’s app or a saved address.
“I’m going move from dev to woodworking. It is safer. Call me again when people fixed everything,” Nicolas Dorier, the founder of BTCPay Server, joked.
