SlowMist Alerts to Critical PHP Vulnerabilities, LiteLLM Backdoor, and Next.js Flaws

icon币界网
Share
AI summary iconSummary
On-chain news: Blockchain security firm SlowMist has issued a crypto scam alert regarding two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0. These flaws could enable unauthenticated remote code execution. PHP released patched versions on October 21. MistEye scanned the crypto industry for PHP assets. The vulnerabilities occur amid a broader wave of security incidents, including a backdoor in LiteLLM 1.107.0, two severe flaws in Next.js, and breaches at PingCAP and BeyondTrust.
CoinDesk reports:

Security Alert: PHP Vulnerability, LiteLLM Backdoor, and Next.js Defect Require Prompt Patching

Blockchain security firm SlowMist warns that cryptocurrency exchanges, DeFi platforms, and wallet providers should promptly patch two critical PHP vulnerabilities, as attackers are already exploiting them.

The two vulnerabilities are CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4.0 score of 9.2. SlowMist stated that these flaws could allow unauthenticated attackers to execute code on vulnerable servers.

PHP released patched versions on October 21: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. SlowMist stated that after the vulnerability disclosure, its MistEye system scanned PHP assets within the cryptocurrency industry.

These vulnerabilities are part of a broader series of security incidents. Reports indicate that version 1.107.0 of LiteLLM was backdoored to steal cloud, SSH, and AI credentials. Two critical vulnerabilities have also been identified in Next.js, PingCAP’s TiDB Cloud was compromised, and zero-day vulnerabilities in BeyondTrust and Ivanti are currently being actively exploited.

Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information. Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.