Critical PHP Flaw Sparks Warnings for Crypto Exchanges and Payment Sites

A critical security risk that touches millions of websites has cryptocurrency users worried, especially customers of smaller exchanges and crypto payment processors.

On Wednesday, October 21, PHP developers issued emergency fixes for two vulnerabilities collectively called PHP2Shell, with a severity score of 9.2 out of 10.

The bugs could give attackers password-free access to vulnerable servers, let them steal sensitive data, or even take control of websites.

The situation demands immediate attention. Cloudflare confirmed that its customers have already been targeted by attempts to exploit the vulnerabilities.

As a safety measure, several European government websites were also taken offline temporarily.

Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches.

Two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) reported for PHP, the web programming language, affecting servers…

— CZ 🔶 BNB (@cz_binance) October 21, 2026

Which Crypto Platforms Are Most at Risk?

PHP is background software that websites rely on to handle information. When a user logs into an account or completes a payment, PHP can be part of the server's response to that request.

Researchers found a way for attackers to influence how PHP manages computer memory, possibly letting them reach data that the site was intended to keep private.

According to Wiz Research, a successful attack could reveal passwords, authentication tokens and API keys. Those are digital credentials that may unlock accounts or linked services.

For cryptocurrency businesses, the fallout could be severe.

Our analysis points to three categories that stand out as especially exposed:

• Crypto payment gateways: Merchants whose payment systems rely on PHP could face critical risk if their servers are not patched. Documented WooCommerce integrations exist for Binance Pay, Crypto.com Pay, BitPay, CoinGate, and CoinPayments.
• Smaller crypto exchanges: Operators running PHP-based account portals or payment setups may put customer information and sensitive credentials at risk if hackers break into those services.
• DeFi and wallet websites: Attackers could tamper with vulnerable web interfaces to show fake wallet addresses or trick users into approving malicious transactions.

SlowMist’s threat intelligence system, MistEye, has conducted a global scan of PHP-related assets across the crypto industry.

We urge all platforms, DeFi projects, wallet providers, and other relevant parties to assess potential risks and upgrade to the official patched versions…

— SlowMist (@SlowMist_Team) October 21, 2026

These are only assessments of possible exposure, it should be stressed. There is no confirmed evidence that the payment providers or major exchanges named above have been breached through PHP2Shell.

Their built-in integrations for merchants do not by themselves show that their own systems are vulnerable.

Properly patched or isolated infrastructure keeps large exchanges less exposed. Kraken, for example, said it finished switching its core backend from PHP to Rust in 2025.

Blockchain networks, smart contracts, and private keys protected in offline hardware wallets are not exposed directly by these PHP vulnerabilities.

What Should Crypto Users Do Now?

Users cannot apply the PHP security patch themselves; website operators have that responsibility. Still, a few steps can help limit possible losses.

• Watch for official security updates from your exchange and look for confirmation that its web systems are patched.
• Turn on strong two-factor authentication or passkeys. Use withdrawal address allowlists when they are offered.
• Double-check payment addresses. Before sending crypto, confirm the destination through a trusted channel, especially on unfamiliar payment sites.
• Treat urgent security alerts with suspicion. Hackers may exploit the attention around this issue to spread fake login pages or malicious wallet-connection prompts.

There is no need to assume every crypto exchange is compromised or to pull funds out immediately.

The key question is whether platforms have protected their exposed PHP services. Until patching is verified, sites that process cryptocurrency payments deserve extra caution.