Critical PHP2Shell Flaw Poses Security Risk to Crypto Payment Sites and Exchanges

PHP developers released emergency patches for two critical vulnerabilities, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), rated 9.2 out of 10 severity, which could allow hackers to access vulnerable servers without passwords and steal sensitive information like passwords, authentication tokens, and API keys. Crypto payment gateways using PHP integrations (e.g., Binance Pay, CoinGate, BitPay) and smaller PHP-based exchanges face potential exposure, while major exchanges are less at risk if properly patched. Cloudflare confirmed attackers have attempted to exploit these flaws, and several European government websites were temporarily shut down as a precaution.