On October 21, 2026, blockchain security firm SlowMist issued a critical global security alert regarding two severe vulnerabilities in PHP that could expose cryptocurrency platforms to significant risk. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, received a CVSS v4.0 score of 9.2, indicating critical severity.
The warning, amplified by WuBlockchain, highlighted that the vulnerabilities could allow unauthenticated attackers to execute code on vulnerable servers. SlowMist's MistEye threat intelligence system identified the flaws, which are particularly concerning for crypto exchanges, DeFi platforms, and wallet providers that rely on PHP for backend infrastructure.
According to the alerts, official PHP security patches were released on October 21 for several affected versions, but organizations were urged to audit their PHP installations immediately, prioritize internet-facing services, and apply updates without delay. The vulnerability disclosure underscores the ongoing need for stronger security measures across the crypto sector.
The broader digital asset market showed mixed signals amid the warning, with traders and developers monitoring how quickly platforms implement the fixes. Delays in patching could raise concerns about platform security and affect confidence in affected services.
