Two vulnerabilities in PHP, rated 9.2 out of 10, can let attackers run code on servers without logging in. SlowMist found PHP on 793 of 1,488 crypto industry domains it scanned. No crypto platform breach had been tied to the flaws by early Thursday.
PHP's maintainers released emergency fixes on Wednesday for two critical flaws in one of the most widely used programming languages on the web. For the crypto industry, the risk is less the trading engines than the websites wrapped around them.
The flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed "php2shell," can allow unauthenticated remote code execution on servers running PHP versions 5.4 through 8.5.11. Each carries a severity score of 9.2. Fixes were released at 13:30 UTC on Wednesday, and the U.S. Cybersecurity and Infrastructure Security Agency said it "strongly urges organizations to immediately patch," by moving to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. CISA said it had not observed exploitation at the time of its alert.
The exposure
Palo Alto Networks' Unit 42 counted about 22.6 million exposed PHP instances and said it had seen proof-of-concept code.
The crypto-specific figure comes from SlowMist, a blockchain security firm, which said it found PHP fingerprints on 793 of 1,488 crypto industry domains it scanned, about 53%. It warned exchanges, decentralized-finance front ends and wallet services to patch.
Where the risk sits
Large exchanges generally do not run their matching engines on PHP. The exposure is in the layers around them: marketing sites, account portals, payment plug-ins and the front ends that users interact with, along with smaller venues and service providers.
The most dangerous period for a flaw like this is the days after disclosure, while attackers adapt public proof-of-concept code and before every server is patched.
Three readings
The flaw may be contained quickly: large platforms patch fast and web-application firewalls can block known attack patterns. It may linger in a long tail of small payment sites and plug-ins that patch slowly. Or it may prove mainly a general technology story, with the crypto exposure no greater than any other industry's.
What to watch
Any confirmed compromise of a crypto platform linked to the flaws; patch-status statements from exchanges and wallet providers; and further advisories from CISA and European cybersecurity agencies.