SlowMist warned that two critical PHP vulnerabilities could put Web3 off-chain services at risk. BlockBeats reported that CVE-2026-109618 and CVE-2026-109619 each carry a CVSS v4.0 score of 9.2, and unauthenticated crafted requests could enable arbitrary code execution with the privileges of the web-service process.
More than half of scanned crypto domains showed PHP fingerprints
The vulnerabilities affect PHP 5.4 through 8.5.11. SlowMist said Amazon threat intelligence observed exploitation attempts four days before public disclosure. Its MistEye scan found direct PHP fingerprints on 793 of 1,488 crypto-related domains, or about 53.3%, putting websites, APIs, airdrop pages, administration panels and hosted-wallet services among the potential exposure points.
Projects urged to patch supported branches
PHP fixes are available in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Projects running PHP 8.1 or earlier should migrate because those branches no longer receive regular upstream support.