Crypto Exchange Warning: Critical PHP Flaw Puts Payment Sites at Risk

A critical security threat affecting millions of websites has raised concerns for cryptocurrency users, particularly those using smaller exchanges and crypto payment services.

On Wednesday, October 21, PHP developers released emergency patches for two vulnerabilities known as PHP2Shell, rated 9.2 out of 10 for severity.

The flaws could allow hackers to access vulnerable servers without passwords, steal sensitive information, or potentially take control of websites.

The warning is urgent. Cloudflare confirmed that attackers have already attempted to exploit the vulnerabilities against its customers. 

Several European government websites were also temporarily shut down as a precaution.

Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches.Two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) reported for PHP, the web programming language, affecting servers…

— CZ 🔶 BNB (@cz_binance) October 21, 2026

Which Crypto Platforms Face the Greatest Risk?

PHP is software that websites use behind the scenes to process information. When someone logs into an account or makes a payment, PHP may help the server handle that request.

Researchers discovered that attackers can manipulate how PHP handles computer memory, potentially gaining access to information the website was supposed to protect.

According to Wiz Research, successful attacks could expose passwords, authentication tokens and API keys. These are digital credentials that can provide access to accounts or connected services.

For cryptocurrency platforms, the consequences could be serious.

Our analysis identifies three particularly exposed categories:

• Crypto payment gateways: Merchants using PHP-based payment integrations face potentially critical exposure if their servers remain unpatched. Binance Pay, Crypto.com Pay, BitPay, CoinGate, and CoinPayments all have documented WooCommerce integrations.
• Smaller crypto exchanges: Platforms operating PHP-based account portals or payment systems could expose customer information and sensitive credentials if hackers compromise those services.
• DeFi and wallet websites: Vulnerable web interfaces could potentially be altered to display fraudulent wallet addresses or trick users into approving malicious transactions.

SlowMist’s threat intelligence system, MistEye, has conducted a global scan of PHP-related assets across the crypto industry.We urge all platforms, DeFi projects, wallet providers, and other relevant parties to assess potential risks and upgrade to the official patched versions… pic.twitter.com/mPEeA3QLPq

— SlowMist (@SlowMist_Team) October 21, 2026

Importantly, these are assessments of possible exposure. There is no verified evidence that the named payment providers or major exchanges have been compromised through PHP2Shell. 

Their merchant integrations do not establish vulnerabilities in their own infrastructure.

Large exchanges with properly patched or isolated infrastructure face lower exposure. For example, Kraken reported completing its core backend migration from PHP to Rust in 2025.

Blockchain networks, smart contracts, and private keys stored securely in offline hardware wallets are not directly affected by these PHP vulnerabilities.

What Should Every Crypto User Do Now?

Users cannot install the PHP security fix themselves. That responsibility belongs to website operators. However, several precautions can reduce potential losses.

• Check your exchange’s official security announcements. Look for confirmation that its web infrastructure has been patched.
• Enable strong two-factor authentication or passkeys. Use withdrawal address allowlists where available.
• Verify payment addresses carefully. Before sending cryptocurrency, confirm the destination through a trusted channel, particularly when using unfamiliar payment websites.
• Beware of emergency security messages. Hackers may exploit the publicity to circulate fake login pages or malicious wallet-connection requests.

There is no reason to assume every crypto exchange is compromised or immediately withdraw funds.

The immediate concern is whether platforms have secured their exposed PHP services. Until patching is confirmed, websites handling cryptocurrency payments warrant particular caution.