HuoXing Finance reports that on October 23, the SlowMist Security Team released an in-depth analysis report on two high-severity PHP vulnerabilities, stating that these recently disclosed flaws pose a systemic risk to the “off-chain” components of the Web3 industry. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, both carry a CVSS v4.0 score of 9.2, classifying them as critical. Attackers can execute arbitrary code with the privileges of the web service process by simply sending specially crafted requests to PHP services exposed on the public internet—no account credentials or API keys are required. SlowMist noted that all PHP versions from 5.4 through 8.5.11 are affected, and details of the vulnerabilities were leaked prior to the official patch release. The Amazon Threat Intelligence Team observed actual exploitation attempts four days before public disclosure. SlowMist’s threat intelligence system, MistEye, scanned 1,488 cryptocurrency-related domains and found that 793 of them (approximately 53.3%) exhibited direct PHP fingerprints. This indicates that a significant number of off-chain Web3 infrastructure components—including frontend pages, API endpoints, airdrop claim pages, operational backends, and hosted wallet services—are likely running on vulnerable PHP environments. SlowMist emphasized that Web3 security cannot focus solely on on-chain smart contracts. If attackers exploit these PHP vulnerabilities to compromise a project’s web server, they can alter frontend pages to trick users into signing malicious transactions, directly stealing assets. Even if on-chain contracts are free of vulnerabilities, the off-chain components supporting them may still be insecure. For remediation, official patches have been released in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35; affected projects should upgrade immediately. PHP 8.1 and earlier versions have ceased receiving upstream support and should be migrated as soon as possible. SlowMist also cautioned that temporary mitigation measures—while reducing risk from specific attack vectors—are not a complete solution; applying patches remains the only definitive fix.
SlowMist Reports Critical PHP Vulnerabilities Affecting Web3 Off-Chain Infrastructure
MarsBitShare
Summary
Web3 news: SlowMist disclosed two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting off-chain infrastructure. Rated 9.2 on CVSS v4.0, they enable unauthenticated code execution. On-chain news platforms reported that 53.3% of 1,488 crypto domains were exposed. All PHP versions from 5.4 to 8.5.11 are affected. Exploits were observed four days before patches were released. SlowMist urged users to upgrade to PHP 8.5.12 or later.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.