Crypto security chiefs sound alarm as PHP emergency patch scrambles devs worldwide

PHP released emergency patches on Oct. 21 for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated attackers to execute code on web servers. Crypto security executives are urging operators to patch promptly and audit overlooked infrastructure. The story is a general security advisory with no direct price catalyst, though unpatched crypto services could face elevated exploit risk.