Trendi

Two incidents, two doors in: what PHP2Shell and the Binance theft mean for business websites

By Trendi · Published

Facts as of 2 November 2026; Binance figures may change

Unpatched server software and compromised staff devices featured in this fortnight's major security stories, though the cause of the Binance incident is still unclear. Here is a calm checklist for site owners.

Two unrelated security events have drawn global attention. Trendi, which helps businesses with SEO, AI visibility and website security, sets out what is known and what site owners can do.

What happened

PHP2Shell: flaws in PHP itself

CVE-2026-109618 and CVE-2026-109619 can allow unauthenticated remote code execution, and CERT-EU rates both CVSS 9.2 [5]. They are in PHP itself (the language runtime), not in a plugin [1]. PHP says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and it considers mod_php the highest risk [1].

PHP released fixes on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 [1]. PHP 8.1 and older no longer receive updates from the PHP project, although some distributions and long-term-support vendors provide backported fixes [1].

Exploitation attempts began before the patches were released. Several security firms, including Cloudflare and Amazon, detected widespread attempts but described them as unsuccessful at the time [4]. On 24 October a researcher's honeypots recorded 35 shells launched across three honeypots, which SecurityWeek reported as the first confirmed code execution [3]. The researcher cautioned that the honeypots used a deliberately favourable single-worker mod_php setup, so the result is not a measure of how reliably the exploit works elsewhere [3].

On 26 October CISA added both flaws to its Known Exploited Vulnerabilities catalogue and urged organisations to patch immediately. It said a web application firewall (WAF) may provide some protection until systems are patched [2]. CISA's alert lists alerts from cyber security agencies in New Zealand, the UK, Australia and Canada [2].

PHP has also disclosed a further flaw, CVE-2026-115560, which it says needs an unusual combination of configuration and application code. Until the next regular release, it advises setting session.upload_progress.enabled=0 [1][5].

Binance: a record theft, cause still under investigation

On or about 29 October, Binance lost an estimated US$6.3 billion in token assets from its hot wallets [6][7]. CNBC describes it as the largest crypto theft on record [7].

Binance's initial investigation suggested the incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions. Binance said it had found no evidence of a wallet private key leak [6]. Co-CEO Richard Teng later said the attack involved a more complex process than the misuse of a single engineer's permissions, according to CNBC [7]. How the attack took place is still not clear [7].

Binance said about US$3 billion had been frozen on-chain with blockchain partners [6]. It temporarily suspended withdrawals and said it, not its users, would absorb the losses [6][7]. On 31 October Binance said it had restored backing for about 90% of affected assets; CNBC notes that this is not the same as recovering 90% of the stolen funds [7]. Binance began resuming withdrawals in phases on 1 November, starting with bitcoin [7].

On 31 October the FBI said North Korea was responsible for the theft of more than US$6 billion from Binance, activity it calls "TraderTraitor" [8].

Why it matters for ordinary business websites

These events point to two ways in: unpatched server software, and compromised staff devices and credentials. Binance's initial findings point to the second, though its root cause is still being investigated [6][7]. Small business sites face the first one directly.

CISA notes that PHP is often a component of other software, so it may not be obvious where it runs [2]. In the same week, CISA added actively exploited flaws in Adobe Commerce and Magento (CVE-2026-48356, known as PolyShell, a file-upload flaw) and GitLab (CVE-2026-97229) to its catalogue [9][10]. The Hacker News reports that Sansec saw attackers use PolyShell to breach hundreds of online stores [9].

Six steps every site should take now

  1. Patch PHP and dependencies. Move to a fixed PHP release, update your CMS and plugins, and move off PHP 8.1 or older, or get a backported fix from your host or vendor [1]. If you do not manage the server yourself, ask your host which PHP version you run.
  2. Use a WAF as a stopgap. It may give some protection until patching is done, but it is not a substitute for patching [2].
  3. Set security headers. Deploy a Content Security Policy (CSP) and HTTP Strict Transport Security (HSTS) alongside other standard headers. You can see which headers your homepage sends with our website security check.
  4. Keep tested, offline backups. Restore from them regularly so you know they work.
  5. Turn on MFA and protect devices. Cover admin, hosting, DNS, email and developer accounts, and staff laptops.
  6. Monitor and log. Watch for unexpected processes and files on your servers, such as PHP worker processes launching shells or downloading tools [2].

About Trendi

Trendi helps businesses worldwide improve how they show up in search and AI answers. Security audits and penetration testing are a separate service, scoped and quoted on enquiry. Self-serve tools include a website security check and a robots.txt checker for AI crawlers.

Media contact: Trendi, admin@trendibizz.com

Sources

  1. PHP project security advisory, 21 Oct 2026: php.net news archive (advisory) · PHP 8.4.27 release announcement
  2. CISA alert, “Critical Vulnerabilities in PHP Require Immediate Patching” (updated 23 and 26 Oct 2026): cisa.gov
  3. SecurityWeek, “PHP2Shell Exploitation Moves From Probes to Working Shells”, Oct 2026: securityweek.com
  4. BleepingComputer, “CISA confirms PHP2Shell vulnerabilities now exploited in attacks”, 27 Oct 2026: bleepingcomputer.com
  5. CERT-EU security advisory 2026-018, “Critical Vulnerabilities in PHP”: cert.europa.eu
  6. Binance, “Security Incident Update (2026-10-30)”: binance.com
  7. CNBC, “Binance resumes withdrawals following record $6.3 billion hack”, Nov 2026: cnbc.com
  8. FBI, “North Korea Responsible for $6 Billion+ Binance Attack”, 31 Oct 2026: fbi.gov
  9. The Hacker News, “Adobe Commerce PolyShell Attacks Breach Hundreds of Stores”, 28 Oct 2026; NVD entry for CVE-2026-48356; Sansec research on PolyShell: thehackernews.com · nvd.nist.gov · sansec.io
  10. The Hacker News, “CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV”, 30 Oct 2026: thehackernews.com

Related: Penetration testing · Website security check · Report a security issue