On October 21, 2026, developers released emergency patches for two critical PHP vulnerabilities, collectively known as PHP2Shell. These flaws, identified as CVE-2026-109618 and CVE-2026-109619, carry a severity rating of 9.2 out of 10. They allow unauthorized access to servers, potentially enabling hackers to steal sensitive data, including passwords, authentication tokens, and API keys.
Cloudflare reported that attackers have already attempted to exploit these vulnerabilities. Several European government websites were temporarily taken offline as a precautionary measure. Researchers from Wiz Research noted that the flaws involve the manipulation of computer memory, which could grant attackers control over affected web servers.
The security threat poses risks to crypto payment gateways and smaller exchanges that utilize PHP-based infrastructure. While major platforms like Binance Pay, Crypto.com Pay, BitPay, CoinGate, and CoinPayments offer WooCommerce integrations, there is no evidence that these specific providers have been compromised. Kraken, for instance, migrated its backend from PHP to Rust in 2025.
SlowMist has initiated a global scan of PHP-related assets within the crypto industry via its MistEye system. The firm advises all DeFi projects and wallet providers to update their systems immediately. Blockchain networks, smart contracts, and assets stored in offline hardware wallets remain unaffected by these specific server-side vulnerabilities.
Users are advised to monitor official security announcements from their exchanges and confirm that infrastructure has been patched. Recommended security measures include enabling two-factor authentication, utilizing withdrawal address allowlists, and verifying payment addresses through trusted channels. Users should also remain cautious of potential phishing attempts.
