SlowMist Warns Crypto Firms After Two Critical PHP Vulnerabilities Rated 9.2

SlowMist warns cryptocurrency exchanges, DeFi platforms and wallet providers about two critical PHP remote code execution vulnerabilities.

Blockchain security firm SlowMist has warned cryptocurrency exchanges, decentralized finance (DeFi) platforms and wallet providers to review their systems after two critical PHP vulnerabilities were disclosed, each receiving a severity score of 9.2 under the CVSS v4.0 rating system.

According to information shared by Wu Blockchain, SlowMist used its MistEye threat intelligence system to conduct a global scan of PHP-related assets across the cryptocurrency industry following the disclosure of the flaws, identified as CVE-2026-109618 and CVE-2026-109619.

Both vulnerabilities involve potential remote code execution, a class of security weakness that can allow attackers to run code on a vulnerable server. Under certain conditions, the two flaws could enable unauthenticated attackers to execute code on affected systems, creating a security concern for organizations that rely on exposed or unpatched PHP environments.

Two Critical Vulnerabilities Raise Security Concerns

The vulnerabilities have been assigned CVE identifiers CVE-2026-109618 and CVE-2026-109619. Both received scores of 9.2 under the Common Vulnerability Scoring System version 4.0 (CVSS v4.0), placing them in the critical severity category.

The reported risk centers on the possibility of remote code execution without authentication under certain conditions. If an affected server is vulnerable and the necessary conditions are met, an attacker could potentially execute code without first logging in. The extent of the risk to an individual organization depends on its systems and exposure to the affected software.

For cryptocurrency businesses, the warning underscores the importance of identifying vulnerable infrastructure and applying security updates. Exchanges, DeFi platforms and wallet providers operate technology environments that may include web-facing services, making timely vulnerability assessment and patch management important parts of their security practices.

PHP Releases Security Updates

PHP released security patches on October 21, addressing the affected software through updates for four branches of the programming language: PHP 8.5.12, PHP 8.4.27, PHP 8.3.36 and PHP 8.2.35.

Organizations using PHP should assess which versions are deployed across their infrastructure and determine whether their systems require the relevant updates. Applying the appropriate patched version is a key step in addressing vulnerabilities covered by the release, although organizations must also evaluate their own configurations and exposure.

The availability of updates gives affected organizations a concrete remediation step. However, identifying every potentially affected asset can be challenging when infrastructure spans multiple services, applications and environments. SlowMist's MistEye scan was conducted to assess PHP-related assets across the global cryptocurrency industry after the two vulnerabilities were disclosed.

SlowMist Urges Crypto Platforms to Review Exposure

SlowMist specifically urged cryptocurrency exchanges, DeFi platforms and wallet providers to assess their exposure to the vulnerabilities and apply the security updates promptly. The warning places emphasis on both identifying affected systems and ensuring that the relevant patches are installed.

The disclosure does not, in the information provided by Wu Blockchain, establish that the vulnerabilities have been exploited in attacks against cryptocurrency businesses. Nor does it quantify the number of affected services or organizations. The reported concern is the potential for unauthenticated remote code execution under certain conditions and the need for affected operators to respond to the available security fixes.

The immediate security priorities identified by SlowMist are to review PHP-related infrastructure, determine whether the affected software is in use and apply the appropriate patches. The updates released on October 21 cover PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Writer: Victoria Hale
Technology & Blockchain Writer

Victoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.

She prioritises clarity and accuracy when explaining technical developments to a general audience.

Check out other news and articles on Google News

Disclaimer:

The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.