PHP Two High-Severity Vulnerabilities Both Score 9.2 on CVSS; SlowMist Advises Web3 Projects to Upgrade Immediately

Odaily reports: The SlowMist security team has released a report stating that two recently disclosed high-severity PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are posing risks to the off-chain infrastructure of the Web3 industry. Both vulnerabilities have a CVSS v4.0 score of 9.2. Attackers do not need an account password or API key—simply sending a crafted request to a PHP service exposed to the public internet may allow them to execute arbitrary code with the privileges of the web service process.The vulnerabilities affect all versions of PHP from 5.4 to 8.5.11, and details of the flaws leaked before the official patches were released. Amazon's threat intelligence team observed actual exploitation attempts 4 days before public disclosure. Scanning by SlowMist's threat intelligence system MistEye shows that among 1,488 crypto-related domains surveyed, 793 carry direct PHP fingerprints, accounting for approximately 53.3%.Affected off-chain infrastructure includes Web3 project frontend pages, API interfaces, airdrop claim pages, operations backends, and custodial wallet services. If attackers exploit the PHP vulnerabilities to compromise a project's web server, they may tamper with frontend pages and trick users into signing malicious transactions, thereby stealing assets.Official releases of PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 have been published, and affected projects should upgrade to the corresponding latest versions. PHP 8.1 and earlier versions have reached end-of-life for upstream regular support and should be migrated as soon as possible. Temporary mitigation measures taken when an immediate upgrade is not possible can only reduce the risk of specific attack paths; applying the patch remains the definitive solution.