Crypto Exchange Warning: Critical PHP Flaw Puts Payment Sites at Risk

On Wednesday, Oct. 21, developers of PHP, a web programming language, released emergency patches for two PHP2Shell vulnerabilities rated 9.2 out of 10, flaws that could let attackers access unpatched servers without passwords, steal information or take control of websites. Cloudflare confirmed exploit attempts against its customers, and several European government sites were temporarily shut down as a precaution. The warning focused on cryptocurrency users, especially smaller exchanges and payment services; Wiz Research said attacks could expose passwords, authentication tokens and API keys. Binance Pay, Crypto.com Pay, BitPay, CoinGate and CoinPayments have documented WooCommerce integrations, but no verified evidence shows they were compromised through PHP2Shell, while Kraken said in 2025 it had moved its core backend from PHP to Rust.