PHP2Shell patched as Cloudflare confirms attempts — crypto platforms told to check their shell 🐚

PHP developers released emergency patches on Wednesday, October 21, 2026, for two vulnerabilities known as PHP2Shell, rated 9.2 out of 10 for severity, as Cloudflare confirmed that attackers had attempted to exploit the flaws against its customers. The issue affects millions of websites, and several European government websites were temporarily shut down as a precaution. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, could allow hackers to access vulnerable servers without passwords, steal sensitive information or potentially take control of websites.

PHP is software that websites use behind the scenes to process information, including when someone logs into an account or makes a payment. Researchers discovered that attackers can manipulate how PHP handles computer memory, potentially gaining access to information the website was supposed to protect. According to Wiz Research, successful attacks could expose passwords, authentication tokens and API keys, which are digital credentials that can provide access to accounts or connected services.

SlowMist’s analysis identified three particularly exposed crypto categories: crypto payment gateways using PHP-based integrations, smaller crypto exchanges operating PHP-based account portals or payment systems, and DeFi and wallet websites. Unpatched payment servers could face critical exposure, compromised exchange systems could expose customer information and credentials, and altered DeFi or wallet interfaces could display fraudulent wallet addresses or trick users into approving malicious transactions.

Binance Pay, Crypto.com Pay, BitPay, CoinGate and CoinPayments all have documented WooCommerce integrations. SlowMist’s threat intelligence system, MistEye, has conducted a global scan of PHP-related assets across the crypto industry. SlowMist said, “We urge all platforms, DeFi projects, wallet providers, and other relevant parties to assess potential risks and upgrade to the official patched versions.”

These assessments concern possible exposure. There is no verified evidence that the named payment providers or major exchanges have been compromised through PHP2Shell, and their merchant integrations do not establish vulnerabilities in their own infrastructure. CZ 🔶 BNB (@cz_binance) wrote on October 21, 2026: “Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches.”