21 Oct 2026 [security] [CCS]

Monero CCS website temporarily 'disabled' after disclosure of critical PHP vulnerabilities

Core Team member binaryFate1 has temporarily disabled the Monero Community Crowdfunding System (CCS)2 website/app after the public disclosure3 of two critical PHP vulnerabilities that can allow remote code execution:

Hey everyone FYI, in the light of the PHP RCE issues I have disabled the CCS website/app as an emergency measure until we find out how to upgrade safely. (binaryFate)4

Earlier today, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These releases fix two critical vulnerabilities that, under the right conditions, allow an unauthenticated attacker to execute code on servers running PHP. If you run PHP, it is imperative that you update now.5

It is worth noting that around 70% of all websites run on PHP and were affected by the CVSS 9.2 PHP2Shell6 RCE flaws (tracked as CVE-2026-109618 and CVE-2026-1096197).

This is an ongoing story and the report will be updated when new information is available.

  1. https://github.com/binaryFate/ ↩

  2. https://ccs.getmonero.org/ ↩

  3. https://www.php.net/archive/2026.php#2026-10-21-5 ↩

  4. https://libera.monerologs.net/monero-site/20261021#c715683 ↩

  5. https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ ↩

  6. https://php2shell.com/ ↩

  7. https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w, https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp ↩