Protecting your trust.
Building what comes next.

20 Nov — 11 Dec 2026

We aim to restore services during this period, subject to the completion of technical and security checks.

Recent reports have highlighted serious security concerns affecting certain PHP-based applications and server configurations. PHP is widely used across the web, and exposure can depend on the installed version, hosting configuration, third-party dependencies and whether security updates have been applied.

Potential risks in vulnerable web environments include unauthorized access, exposure of sensitive information and disruption of online services. A vulnerability affecting a technology does not mean that every website using it has been compromised.

As a precaution, Crbcoin has restricted public access while its technical team assesses affected components, reviews server and application configurations, applies relevant updates and validates the environment before reopening. We are not announcing a confirmed breach of Crbcoin systems.

Independent technical advisories and media coverage are grouped under “Independent reporting and security advisories” below.

We understand that temporary interruption of the website and exchange may be concerning for existing CRB holders. The planned upgrade is intended to restore access to your wallet information and CRB balances through the renewed Crbcoin Exchange.

Our intention is that existing CRB holdings remain unaffected by this website transition. Once the renewed exchange is available, holders should be able to view their wallets and CRB balances again. Access will be restored following technical reconciliation and verification of account records.

If you have any questions about your holdings or account access, please contact ticket@crbcoin.com. For your security, never send your wallet recovery phrase, private keys or password by email.

Public attention to PHP security issues has led website operators to review their exposure and, in some cases, temporarily restrict services while assessing or applying fixes.

Such interruptions can be precautionary. An offline website is not proof that it has been hacked. Crbcoin is taking a preventive approach rather than waiting for a confirmed incident.

For external reporting and official advisories, see the next section. Individual third-party incidents should be treated as confirmed only where the relevant organization or a reliable source has substantiated them.

These independent sources are provided for context. Their coverage and links should be verified before this notice is published; they do not assess or certify Crbcoin.

Security agencies in multiple countries have issued technical warnings and recommendations about these vulnerabilities. The following links explain the incident and provide independent guidance. They do not indicate that Crbcoin has suffered a security breach.

• WIRED — international reporting: context on the vulnerabilities, urgent patching and the wider response.
• The Verge — global website disruptions: accessible explanation of the technical issue and precautionary outages.
• Netherlands — National Cyber Security Centre: operational guidance, affected environments and fixed PHP versions.
• United Kingdom — NHS England Cyber Alert: official security bulletin covering technical impact and remediation.
• Canada — Canadian Centre for Cyber Security: government alert outlining the vulnerabilities, supported fixes and recommended actions.

References are provided for transparency. Each authority or publisher speaks for its own findings; none has certified Crbcoin's systems.

Crbcoin is planning a security-focused architecture designed to reduce attack exposure, limit unauthorized access and support the responsible processing of sensitive personal and financial information. The following are engineering objectives under review, not claims of existing certification or completed deployment.

• Zero Trust principles: explicit verification of users, services and devices; least-privilege access; segmentation between public-facing services, administrative systems and sensitive workloads.
• Encryption and key management: TLS 1.3 where supported, strong encryption for stored sensitive data, managed encryption keys, rotation procedures and protected secret storage.
• Identity and access: multi-factor authentication, role-based access control, privileged access management, secure session handling and administrative audit trails.
• Application and API protection: secure API gateways, input validation, rate limits, web application firewall controls, anti-automation safeguards and DDoS mitigation.
• Secure software delivery: supported dependencies, dependency and software-bill-of-materials review, automated vulnerability scanning, code review, isolated deployment environments and timely patch management.
• Operational resilience: centralized logging, alerting, incident response playbooks, tested backups, disaster recovery procedures and controlled restoration of services.
• Independent assurance: penetration testing and vulnerability remediation prior to production release, with security requirements informed by OWASP ASVS and NIST Cybersecurity Framework guidance.

Our objective is to create a platform where security is built into architecture, development and day-to-day operations rather than added as an afterthought.

The renewed Crbcoin Exchange is being designed to connect wallet-authorized payments directly with blockchain transaction verification, using USDC on the Base network. The goal is a more streamlined checkout with clear payment instructions, transparent transaction status and verifiable on-chain settlement.

Why USDC? USDC is a US-dollar-referenced stablecoin issued by Circle, which publishes information about its reserves and redemption framework. For eligible EU activity, Circle's EU-issued USDC is issued under the EU Markets in Crypto-Assets Regulation (MiCA) framework. This does not by itself establish that Crbcoin or its exchange is MiCA-authorized.

Why Base? Base is an Ethereum Layer 2 network designed for lower transaction fees and efficient transfers while benefiting from the broader Ethereum ecosystem. Blockchain transactions remain subject to network conditions, fees and settlement risk; no blockchain is risk-free.

Transparent verification: the proposed flow will verify the correct network, official USDC token contract, receiving address, amount, transaction hash and required confirmations before showing a completed payment. Users should be able to review their transaction through a public blockchain explorer.

Regulatory approach: the project will assess applicable MiCA crypto-asset service requirements, AML/KYC obligations, data-protection rules, sanctions controls and consumer disclosures with qualified legal and compliance advisers before launch. Applicable authorizations depend on the exact services offered and jurisdictions served.

Circle — EU MiCA information ↗  ·  European Banking Authority — USDC classification ↗

Rather than simply restoring the previous experience, we are taking this opportunity to prepare an entirely new Crbcoin website with updated infrastructure, a cleaner interface, improved mobile compatibility, and more transparent information about our platform and services.

Our objective is a modern, maintainable digital environment designed for long-term reliability, accessibility and security.