Two critical vulnerabilities in PHP, one of the world’s most widely deployed server-side programming languages, have triggered international cybersecurity alerts, with blockchain security firm SlowMist warning cryptocurrency exchanges, decentralized finance platforms and wallet providers to urgently review their infrastructure.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, each carry a severity score of 9.2 under the Common Vulnerability Scoring System version 4.0.
Successful exploitation could allow unauthenticated attackers to execute malicious code remotely on affected servers, potentially exposing sensitive information or compromising application infrastructure.
On October 21, 2026, PHP developers released emergency security updates addressing both vulnerabilities, following advance warnings and reports that technical details had circulated before the planned disclosure.
The PHP security team urged administrators to update immediately, emphasizing that alternative mitigations cannot provide complete protection.
SlowMist’s warning highlights the implications for cryptocurrency businesses that depend on PHP-powered websites, application interfaces and supporting infrastructure.
Emergency Patches Address Two Remote Code Execution Flaws
The PHP security team released four patched versions on October 21: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older PHP versions, including unsupported releases, may also be vulnerable and require migration to maintained software. CVE-2026-109618 involves memory corruption associated with out-of-memory handling during request cleanup.
CVE-2026-109619 concerns global state that can retain references to memory belonging to earlier requests, potentially enabling exploitation when that memory is reused. Both weaknesses can lead to remote code execution under vulnerable configurations.
The PHP project identified internet-facing installations using PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed as potentially exposed. It highlighted Apache mod_php as particularly concerning because researchers demonstrated an attack that could execute before application-level code begins processing a request.
European cybersecurity authorities, including ENISA, CERT-EU and Europol’s European Cybercrime Centre, jointly advised organizations to identify affected systems and deploy the official updates. The United Kingdom’s National Cyber Security Centre similarly recommended prioritizing exposed systems and considering temporary shutdowns where immediate remediation was impossible.
The warnings reflect PHP’s extensive use across websites, content management systems and commercial applications, creating a potentially broad attack surface.
SlowMist Highlights Risks to Exchanges and DeFi Infrastructure
SlowMist urged cryptocurrency exchanges, DeFi projects and wallet providers to investigate affected PHP deployments and install official patches. The company reportedly used its MistEye security monitoring system to examine PHP-related exposure across cryptocurrency infrastructure following disclosure of the vulnerabilities.
For centralized exchanges, compromised backend servers could expose administrative interfaces, customer information, authentication systems or operational credentials, depending on how infrastructure is configured. Wallet providers and DeFi applications may face risks involving web interfaces, application programming interfaces and supporting services.
However, compromising a PHP server does not automatically grant access to private keys, blockchain smart contracts or customer assets. The potential consequences depend on whether sensitive systems are connected to the affected infrastructure and what privileges an attacker can obtain.
The Australian Cyber Security Centre and Canada’s Centre for Cyber Security also issued warnings concerning the vulnerabilities. Their assessments illustrate an important distinction between demonstrated exploitability and confirmed widespread compromise.
Although researchers have reproduced attacks and exploit information has circulated publicly, the available evidence does not establish that major cryptocurrency exchanges or DeFi protocols have suffered losses directly attributable to these vulnerabilities.
For affected operators, the priority is identifying PHP installations, upgrading to supported patched versions and reviewing systems for indications of unauthorized access. The incident also underscores the cryptocurrency industry’s dependence on conventional internet infrastructure, even when its financial transactions ultimately settle on decentralized blockchains.
The immediate security outcome will depend on how quickly organizations patch exposed servers and investigate any activity occurring before remediation.
