Monero Observer – Monero CCS website temporarily ‘disabled’ after disclosure of critical PHP vulnerabilities

21 Oct 2026 | Updated 22 Oct 2026

[CCS]

[pinned]

Core Team member binaryFate ^{has temporarily disabled the Monero Community Crowdfunding System (CCS) website/app after the public disclosure of two critical PHP vulnerabilities that can allow remote code execution:}

Hey everyone FYI, in the light of the PHP RCE issues I have disabled the CCS website/app as an emergency measure until we find out how to upgrade safely. (binaryFate)

Earlier today, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These releases fix two critical vulnerabilities that, under the right conditions, allow an unauthenticated attacker to execute code on servers running PHP. If you run PHP, it is imperative that you update now.

It is worth noting that around 70% of all websites run on PHP and were affected by the CVSS 9.2 PHP2Shell ^{RCE flaws (tracked as CVE-2026-109618 and CVE-2026-109619).}

This is an ongoing story and the report will be updated when new information is available.

Update: CCS backend back up (patched) but repo.getmonero.org ^{offline until ‘a staff member had enough time set aside to update’ (plowsof).}