CISA Confirms Active Exploitation of Two Critical PHP Flaws

The Cybersecurity and Infrastructure Security Agency (CISA) confirmed that attackers are exploiting two critical PHP vulnerabilities, raising a potential web infrastructure risk for crypto businesses that use the language.

Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws each carry a 9.2 severity score under version 4.0 of the Common Vulnerability Scoring System. An attacker does not need an account or API key to send a crafted request to an exposed PHP service and run code with the privileges of its web server process.

The vulnerabilities affect PHP services rather than a blockchain or crypto asset, but crypto businesses may face exposure if they run vulnerable PHP. Affected versions range from PHP 5.4 to 8.5.11. PHP released fixes for both on Oct. 21. TokenPost previously covered the potential exposure for Web3 projects.