Two critical vulnerabilities known as “PHP2Shell” are drawing attention across the crypto industry after PHP developers issued emergency patches on October 21. The flaws received a severity rating of 9.2 out of 10 and could allow attackers to access affected servers without a password, steal sensitive information and potentially take control of websites.
The risk extends beyond crypto services. Cloudflare has confirmed that attackers have attempted to exploit the vulnerabilities against its customers, while some European government websites were temporarily taken offline as a precaution. For crypto businesses that rely on PHP to handle account logins, payment requests or administrative functions, the speed of patch deployment will determine how long exposed systems remain at risk.
PHP Memory Handling Provides the Attack Path
PHP is server-side software used by a large number of websites to process requests. When users log in, submit payments or interact with site functions, PHP often handles the underlying data. Researchers found that attackers could manipulate the way PHP processes computer memory and gain access to information that should otherwise remain protected.
Wiz Research said successful exploitation could expose passwords, authentication tokens and API keys. These digital credentials can be linked to website accounts and may also provide access to connected third-party services. For websites that manage digital assets or process crypto payments, stolen credentials could expand the impact beyond the initially affected server.
Crypto Gateways and Smaller Exchanges Need Checks
Three categories of services are considered particularly important to review. The first is crypto payment gateways. Merchants using PHP-based payment integrations, especially those connected to WooCommerce, could face exposure if their servers have not been updated. Public records show that Binance Pay, Crypto.com Pay, BitPay, CoinGate and CoinPayments offer WooCommerce integrations. Those integrations alone, however, do not establish that the companies’ infrastructure is vulnerable.
The second category is smaller cryptocurrency exchanges. If an exchange’s account portal or payment system runs on an affected PHP environment, a successful server compromise could expose customer information and sensitive credentials. Compared with larger platforms that typically have more extensive isolation and patching procedures, smaller providers may need to confirm first whether their websites, administrative panels and third-party plugins still use affected versions.
The third category is DeFi and wallet websites. If a site interface is altered, attackers could redirect users to fake wallet addresses or persuade them to approve malicious transactions. There is currently no verified evidence that the payment providers or major exchanges named above have been breached through PHP2Shell.
Blockchain Networks and Offline Keys Are Not Directly Affected
The risk at the website layer should be separated from the security of blockchain infrastructure and stored assets. PHP2Shell directly targets website servers running PHP. It does not directly affect blockchain networks, smart contracts themselves or private keys held securely in offline hardware wallets.
Likewise, the existence of a PHP or WooCommerce integration in a crypto payment product does not show that the company’s core transaction systems have been attacked. The actual risk depends on whether a specific server runs an affected version, whether the patch has been applied and whether account systems, payment interfaces and administrative functions are properly isolated.
Large exchanges may have lower exposure if they applied the patches promptly or separated critical infrastructure from vulnerable web services. Kraken has said that its core backend migration from PHP to Rust was completed in 2025. That means the direct connection between its core backend and the vulnerabilities must be assessed based on the specific deployment environment, rather than inferred from a website’s technology label alone.
Users Cannot Patch Exchange Servers Themselves
PHP security fixes must be applied by website operators, payment providers or hosting infrastructure providers. Ordinary users cannot install patches directly on an exchange’s servers. Users can monitor whether a platform issues security updates, treat unusual login alerts, password-reset notices and wallet-address changes with caution, and avoid entering exchange passwords or API keys on suspicious pages or approving unknown transactions.
The confirmed facts so far are that PHP developers have released emergency fixes for two vulnerabilities, Cloudflare has identified exploitation attempts targeting its customers, and some European government websites were temporarily closed. Whether a particular exchange, payment gateway or wallet website is affected still depends on its server version, patch status and network-isolation measures. The presence of a PHP integration alone is not enough to determine exposure.