PHP security flaws carrying severity scores of 9.2 have prompted blockchain security firm SlowMist to urge cryptocurrency exchanges, decentralized finance platforms and wallet providers to check their infrastructure and install emergency updates. PHP developers released patches on October 21, 2026, for two vulnerabilities that could let unauthenticated attackers execute code remotely on affected servers.

Key Takeaways

  • PHP released four patched versions to address two vulnerabilities, each rated 9.2 under CVSS version 4.0.
  • SlowMist urged crypto businesses to investigate PHP exposure across websites, interfaces and supporting infrastructure.
  • Demonstrated attacks do not establish widespread compromise or losses at major crypto exchanges or DeFi protocols.

Table of Contents

PHP security flaws put exposed servers in focus

The immediate concern for cryptocurrency businesses is their conventional web infrastructure. Depending on a platform’s configuration, a compromised PHP backend could expose customer information, administrative interfaces, authentication systems or operational credentials.

SlowMist urged exchanges, DeFi projects and wallet providers to identify affected deployments and apply official patches. The company reportedly used its MistEye monitoring system to examine PHP-related exposure across cryptocurrency infrastructure after the vulnerabilities were disclosed.

The risk does not mean that a compromised PHP server automatically gives an attacker access to private keys, smart contracts or customer assets. The consequences depend on connections to sensitive systems and the privileges an attacker can obtain.

Emergency updates cover four PHP releases

The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each received a 9.2 severity score under the Common Vulnerability Scoring System version 4.0. PHP developers addressed them in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older versions, including unsupported releases, may also be vulnerable and require migration to maintained software.

CVE-2026-109618 involves memory corruption linked to out-of-memory handling during request cleanup. CVE-2026-109619 concerns global state retaining references to memory from earlier requests, which could enable exploitation when that memory is reused. Both can permit remote code execution under vulnerable configurations.

The PHP project identified internet-facing installations using PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed as potentially exposed. Apache mod_php drew particular concern because researchers demonstrated an attack capable of executing before application-level code starts processing a request.

The emergency updates followed advance warnings and reports that technical details had circulated before the planned disclosure. PHP’s security team urged immediate updates, warning that alternative mitigations cannot provide complete protection.

International alerts distinguish exposure from confirmed losses

ENISA, CERT-EU and Europol’s European Cybercrime Centre jointly advised organizations to identify affected systems and deploy the updates. The United Kingdom’s National Cyber Security Centre recommended prioritizing exposed systems and considering temporary shutdowns where immediate remediation was impossible.

Australian and Canadian cybersecurity authorities also issued warnings. Researchers have reproduced attacks, and exploit information has circulated publicly, but the available evidence does not establish losses at major cryptocurrency exchanges or DeFi protocols directly attributable to these vulnerabilities.

For affected operators, the stated priorities are to locate PHP installations, upgrade to supported patched versions and review systems for signs of unauthorized access.

Conclusion

The warnings center on patching exposed PHP infrastructure and checking for unauthorized activity. For crypto platforms, the distinction remains important: exploitable web servers present a serious risk, but they are not evidence of confirmed asset losses.

Read More News

More FinanceVelix news

Disclaimer

This FinanceVelix article provides general information, not personalized financial, investment, legal, or tax advice. Market prices, interest rates and economic conditions can change; investments carry a risk of loss. Facts reflect the material available when published and may change. Check important information independently and consult a qualified professional when needed. Mentioning an asset, company, or service is not an endorsement.