SlowMist Urges Web3 Projects to Patch Two PHP Flaws Rated 9.2

SlowMist urged Web3 projects to patch two PHP vulnerabilities immediately, warning that attackers may be able to run code on publicly exposed servers and threaten off-chain crypto infrastructure.

The flaws, CVE-2026-109618 and CVE-2026-109619, each have a CVSS v4.0 severity score of 9.2. An attacker without an account or API key could send a crafted request to an exposed PHP service and execute code with the privileges of its web server process. The vulnerabilities affect PHP versions 5.4 through 8.5.11.

Details of the flaws leaked before official patches were released. Exploitation attempts were observed four days before public disclosure.

A scan of 1,488 crypto-related domains found 793, or about 53.3%, had a direct PHP fingerprint. Potentially exposed Web3 systems include project websites, APIs, airdrop pages, administrative systems and hosted wallets. A compromised server could let attackers alter a site's interface and trick users into signing malicious transactions.

Fixed releases include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier no longer receive routine upstream support; SlowMist urged projects using those versions to migrate.