PHP2Shell flaw draws millions of exploit attempts: what crypto users should know

24 Oct 2026

24 Oct 2026, 04:51 UTC+02:00

A flaw in the language behind most of the web has set off a global patching scramble. On 21 October, researchers from Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. According to Cloudflare, they affect all web servers running PHP 5.4 or later and can allow denial of service, remote code execution and data exposure.

Millions of attempts

Cloudflare chief executive Matthew Prince said the company saw tens of thousands of exploit attempts in the 45 minutes after the announcement, rising to “hundreds of thousands within two hours, and millions now.” Cloudflare also saw thousands of attempts in the 10 hours before disclosure, suggesting a leak. It had deployed firewall protections about nine hours ahead of the announcement.

The fallout was wide. The UK took 32 government services offline as a precaution, and its National Cyber Security Centre sent 50,000 alerts while reporting no successful hacks. The NSA warned that “cyber-actors are likely to weaponise PHP2Shell” and required immediate patching across US agencies. Former NCSC chief Ciaran Martin called it “the most serious vulnerability discovered for five years.” Patched versions include PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. On 23 October the PHP project disclosed a related issue in its session upload progress feature that affects even patched releases.

Why crypto users should care

PHP powers a huge share of websites, including many WordPress sites, small crypto projects, payment plugins and token dashboards. A compromised server can serve fake wallet connect prompts or swap deposit addresses on a page. Large exchanges generally run their own hardened stacks, but smaller services may lag.

What it means for traders

• Be wary of small sites this week: double check deposit addresses and contract approvals.
• Never sign unexpected wallet prompts, even on a site you know.
• Stick to well run platforms: see how we assess exchange security in our testing methodology and our exchange comparison.

Sources

• The Guardian: Websites across world hit by millions of attempts to exploit PHP code flaw
• Cloudflare: Cloudflare deploys protections against php2shell vulnerability
• Datadog Security Labs: PHP2Shell: critical vulnerabilities in PHP

News is for information only and is not financial advice. More crypto news