PancakeSwap says not affected by critical PHP flaws

PancakeSwap issued a reassurance after the disclosure of two critical PHP remote-code-execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619, dubbed "PHP2Shell") prompted security warnings across the crypto industry. The exchange stated it does not use PHP anywhere in its tech stack, that its platform is not affected, and that user funds are safe.

• Statement posted on the exchange's official X account amid industry-wide patching alerts
• Follows warnings from security firms such as SlowMist and companies like Cloudflare about active attack traffic targeting PHP-based sites