PHP2Shell Gets a 9.2: Crypto Platforms Told to Patch the Shell Game

The FBI, National Security Agency (NSA), and Cybersecurity and Infrastructure Security Agency (CISA) have warned organizations to immediately patch two critical PHP vulnerabilities dubbed “PHP2Shell,” which can allow attackers to execute malicious code on vulnerable servers without authentication.

Tracked as CVE-2026-109618 and CVE-2026-109619, both flaws carry a critical CVSS v4.0 score of 9.2. The vulnerabilities can also provide a direct path to a server’s file system, and attackers do not need to log in to exploit them.

In a post dated October 21, 2026, NSA Cyber (@NSACyber) said all organizations using PHP should be prepared for an update addressing the two issues. The agencies made the action effective immediately, as PHP powers websites and web applications worldwide.

The exposure is relevant to crypto exchanges, wallet providers, and decentralized finance (DeFi) platforms that depend on vulnerable web infrastructure. It does not automatically compromise Bitcoin ($BTC), Ethereum ($ETH), or private keys stored securely offline, because the vulnerabilities target web applications rather than the underlying blockchain protocols or offline key storage.

The cited guidance centers on patching affected systems, not on directing users to cash out or pull funds from exchanges. The CryptoNews report by Ahmed Barakat was last updated October 22, 2026.