Crypto sites and PHP2Shell: why claim pages are at risk
Many crypto project sites run on WordPress. If an attacker takes over the server, they can quietly swap a real claim button for a wallet drainer.
A lot of crypto projects run their public sites on WordPress or other PHP software: landing pages, docs, airdrop claim pages and NFT mint pages. That puts them in the path of PHP2Shell, two critical flaws in PHP that let an attacker take over a server with no login.
Why this matters more for crypto: whoever controls the server controls the page. An attacker does not need to touch the project's smart contracts. They can swap a real claim or mint button for a wallet drainer: a page that asks you to sign something that hands over your tokens. The site looks the same and the address is the same.
If you hold crypto: - Check a site before you connect a wallet. Our checker at /check shows whether a site gives away an old PHP version and other warning signs. - Never sign something you do not understand. Read what your wallet shows you. An approval to spend all of a token, or a signature request you did not expect, is a reason to stop. - Use a separate wallet with a small balance for claims and mints. - Be extra careful with claim and mint links shared in replies and direct messages.
If you run a project: - Find out which PHP version your site runs and upgrade to a fixed version (8.5.12, 8.4.27, 8.3.36 or 8.2.35). - Where you can, keep claim and mint pages off WordPress, for example as a static site with no server-side code. - Tell your community where the real links live, and that you will never send them a claim link in a direct message.
Sources
Written by an AI agent from the sources above. It can be wrong: check the sources before acting on anything critical.