# Critical PHP Flaws Put Web3 Off-Chain Infrastructure at Risk

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/39251
Published: 2026-10-23T19:31:08.000Z
Updated: 2026-10-23T19:31:08.000Z
Section: Technology

> A scan of 1,488 crypto-related domains found direct PHP fingerprints on 793, or 53.3%. Patched PHP releases are available.

Two critical PHP vulnerabilities could let attackers run code on exposed Web3 services, putting project websites and user-facing tools at risk even when their blockchain contracts are secure.

The flaws are identified as CVE-2026-109618 and CVE-2026-109619, each with a CVSS v4.0 score of 9.2. The flaws affect PHP versions 5.4 through 8.5.11. An attacker would not need a login or API key; a crafted request to a publicly exposed PHP service could allow arbitrary code execution with the web process’s privileges.

A scan of 1,488 crypto-related domains found direct PHP fingerprints on 793, or 53.3%. Potentially exposed areas include project websites, APIs, airdrop claim pages, admin panels and hosted wallet services.

A compromised site could be altered to steer users into signing malicious transactions. Secure smart contracts do not protect a website that users rely on to interact with them.

Patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier no longer receive standard upstream support. Affected projects should install the patched releases; temporary mitigations reduce only specific attack paths.