On October 22, Trust Wallet said its apps and core systems don't run on PHP, the web software hit by two critical flaws this week, and that users don't need to do anything. BNB Chain and PancakeSwap also said they aren't directly exposed. The risk left for wallet holders is the scam that borrows the headline: a "security update" that asks for your recovery phrase.

Key facts

  • Who: Trust Wallet, with BNB Chain and PancakeSwap also ruling out direct exposure
  • What: Statement that their apps and core systems aren't built on PHP, so the PHP2Shell flaws don't affect users
  • When: October 22, 2026, a day after PHP shipped fixes for CVE-2026-109618 and CVE-2026-109619
  • Source: Trust Wallet's statement on X, reported by U.Today and Crypto Economy

What Trust Wallet said

PHP2Shell is a pair of flaws in PHP, the language that runs a large share of websites. It lets an attacker take over a server without a password. We covered it here on October 22. A wallet app on your phone isn't a PHP website, and Trust Wallet said its apps and core systems aren't built on PHP at all. That's a company speaking about its own systems. Nobody outside can check it line by line. But it fits how mobile wallets work: your keys sit on your device, not on a web server.

Why the scam comes next

Trust Wallet has seen this exact pattern before. After its Chrome extension was compromised in December 2025, which drained about $7 million from 2,596 wallets, a fake Trust Wallet site asked users to enter their recovery phrase for an "important scheduled update with security improvements." A big security headline gives scammers a ready story. This week's story has a scary name.

How to spot the fake

  • It says your wallet is "affected by PHP2Shell" or needs an "urgent security update" or "re-verification."
  • It asks for your 12 or 24 words, your private key, or a signature to "migrate" funds. No real update needs any of these. Trust Wallet says it never asks for them.
  • It arrives by email, text, DM or a pop-up ad, not as a normal update from your phone's app store.
  • Not sure? Run it through our 2-minute scam check. Our guide to hot and cold wallets explains why the phrase is the whole wallet.

Real wallet updates come through the App Store, Google Play or the browser's own extension store. In years of updates, none of them has needed your 12 words.

Sources: U.Today, Crypto Economy, BleepingComputer: Trust Wallet extension attack, December 2025, MalwareTips: fake Trust Wallet security notice.