AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.
Vulnerabilities CVE-2026-109618 and CVE-2026-109619 carry a 9.2 CVSS rating, leaving over half of scanned crypto domains exposed to potential off-chain compromises.
Key points
- The PHP project pushed emergency fixes for two 9.2-severity RCE vulnerabilities spanning PHP versions 5.4 through 8.5.11.
- SlowMist's MistEye system detected PHP fingerprints on 53.3% of 1,488 scanned cryptocurrency industry domains.
- Amazon's threat intelligence detected active exploitation attempts in honeypots on Oct. 17, four days prior to public disclosure.
The PHP project issued emergency updates on Oct. 21 to remediate two critical security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both assigned a CVSS v4.0 rating of 9.2 [1]. The flaws enable unauthenticated remote code execution across public-facing PHP installations running versions 5.4 through 8.5.11 [1]. The release was pushed forward from Oct. 22 after technical details leaked prematurely on Oct. 20 [1]. In a related disclosure, Amazon's threat intelligence team reported observing active exploitation attempts against PHP environments as early as Oct. 17 within its MadPot honeypot infrastructure [1].
Security firm SlowMist warned that the vulnerabilities pose severe risks to off-chain Web3 infrastructure [1]. An audit by SlowMist's threat intelligence system, MistEye, identified direct PHP fingerprints across 793 of 1,488 scanned crypto-related domains, representing 53.3% of the cohort [1]. While smart contract code remains unaffected on-chain, decentralized finance frontends, crypto payment gateways, and hosted wallet services relying on PHP could be exploited [1]. A compromise at the web layer permits attackers to hijack user signing requests, manipulate approval destinations, or expose hot wallet credentials and administrative interfaces [1]. Similar external attack vectors were highlighted when CertiK warned an eMudhra flaw threatened crypto bots.
Off-Chain Vulnerability and User Exposure
The disclosed vulnerabilities stem from memory management failures [1]. CVE-2026-109618 involves an out-of-memory memory corruption flaw where incomplete data structures are misprocessed during cleanup routines, while CVE-2026-109619 permits attackers to achieve remote code execution in PHP-FPM by exploiting stale global state left between sequential worker requests [1]. Remediation requires upgrading to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35, whereas legacy deployments on PHP 8.1 or older have reached end-of-life status and lack standard upstream patches [1].
SlowMist clarified that end-user non-custodial wallets are not inherently cracked by visiting a site, nor is there a mandate for widespread fund withdrawals [1]. However, if administrative servers or off-chain API keys are breached, attackers can deploy deceptive approval transactions on frontend interfaces [1]. The security firm urged operators to separate hot wallets from the web tier and advised users to verify transaction parameters before executing on-chain signatures [1]. As teams inspect their off-chain dependencies, applying strict protocols such as a DeFi risk checklist remains essential to evaluating operational custody and smart contract interactions.
FAQ
Which PHP versions are affected by the vulnerabilities?
PHP versions 5.4 through 8.5.11 are vulnerable. Official security patches were released in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, while PHP 8.1 and earlier require manual migration due to reaching end-of-life.
Are private keys directly at risk from these PHP vulnerabilities?
No. The flaws affect web server environments and do not directly compromise private keys in user wallets, though compromised servers could present deceptive transaction prompts or expose backend API credentials.
Sources
- PHP Unveils Critical “Internet-Wide” Vulnerabilities: How Can Web3 Patch Its “Off-Chain Weaknesses”? — SlowMist
Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.
Top comments (0)