If PHP touched your keys, assume they leaked.
PHP2Shell gives an unauthenticated attacker code execution as your web worker — and one of the two bugs can also read freed worker memory. For a Solana dApp, trading dashboard, NFT mint or exchange tool running PHP, every secret that process could reach is now in scope: hot-wallet keys, RPC provider keys, exchange API secrets, and any mnemonic in the environment.
Upgrading stops new break-ins. It does not un-leak a secret that was already readable by a vulnerable worker. If your PHP tier could read a signing key or API secret, rotate it.
Why crypto teams are exposed
PHP2Shell is two critical (CVSS 9.2), unauthenticated remote-code-execution bugs in the PHP engine itself, fixed on 21 October 2026 and exploited in the wild before the patch shipped. They hit any web-facing PHP worker, whatever framework sits on top.
The advisories describe the impact as code execution and memory disclosure as the web worker. They do not publish a list of what secrets exist on your box — that inventory is yours. The rule of thumb below is ours: if the PHP process could read it, an attacker running as that process could read it too.
What to do now, in order
Work top to bottom. Steps 1–2 stop the bleeding; step 3 assumes the keys already leaked; steps 4–5 confirm and contain. Tick items off as you go — the list is stored only in this browser.
Find keys that should never have been on the server
Drop a .env, a keypair file, or a whole repo folder. Shellproof finds committed Solana keypairs, BIP39 seed phrases, and RPC / exchange API keys. Keypairs show the public address so you know which wallet to rotate; every secret itself stays masked.
Files are read with the local File API and scanned on this page. Nothing you drop is uploaded, logged, or sent anywhere. Reload the page and it is gone.
Has a possibly-compromised wallet moved?
Enter a Solana address to list its most recent transactions straight from an RPC node, then turn on Watch to keep checking every 60 seconds while this tab is open. Each new transaction is marked when the wallet itself signed it — that needs the private key, so a signature you did not make means someone else has it. This is a read-only lookup (getSignaturesForAddress, getTransaction) — Shellproof never builds, signs or sends a transaction.
Can someone else spend your tokens?
A token delegate (an “approval”) can move up to an approved amount out of a token account without the owner signing. Enter a wallet address to list every spl-token and Token-2022 account that still has one. This only reads (getTokenAccountsByOwner); revoking is done from your own wallet.
Keep private keys off the web server
Once you have patched and rotated, change the architecture so the next RCE cannot reach a signing key at all.
A non-custodial bot that signs with a key held on the server — a market-making loop, an auto-claimer, a mint cron — keeps a live signing key within reach of the PHP worker. Those keys are the first thing to move behind a signer service, and the first to rotate after an incident.
Run the same checks on your host
The CLI scans your whole server for exposed keys and signs of compromise. shellproof wallet ADDRESS --watch watches a wallet from a server or cron job and can post to Slack or Discord, and shellproof delegates ADDRESS lists token approvals.