Blockchain security firm SlowMist has issued a critical security alert for cryptocurrency exchanges, decentralized finance (DeFi) platforms, and wallet providers worldwide after two serious vulnerabilities were discovered in PHP, the widely used server-side programming language that reportedly powers around 70 percent of all websites. The flaws could allow attackers to remotely execute code on vulnerable servers. Because PHP sits beneath such a large share of the web, weaknesses in the language itself can affect any application built on it, regardless of the quality of the application's own code.

According to a statement from SlowMist, the company's MistEye threat intelligence system conducted a global scan of PHP-based infrastructures across the cryptocurrency sector after the vulnerabilities came to light.

The two flaws, identified as CVE-2026-109618 and CVE-2026-109619, each received a risk score of 9.2 out of 10 under the CVSS 4.0 system, a rating that classifies them as a critical security threat. CVSS is the standardized framework used across the security industry to rate vulnerability severity, and scores of 9.0 or higher fall into its most severe category.

Unauthenticated Code Execution

According to security experts, the vulnerabilities could, under certain conditions, allow attackers to execute malicious code on vulnerable servers without requiring any authentication. Authentication is often the first barrier limiting who can reach a server's functions, so flaws that bypass it are treated with particular urgency, especially on systems exposed to the public internet.

The technical details show that the first vulnerability stems from how PHP handles memory shortages, while the second arises from the possibility of using expired memory data between server requests.

If successfully exploited, the flaws could enable attackers to compromise server infrastructure and access sensitive data. The potential risk is considered particularly high for cryptocurrency platforms that provide services involving user accounts and financial transactions. The episode also underscores that security in the cryptocurrency sector extends beyond blockchain protocols to the conventional web infrastructure underpinning exchanges, wallets, and DeFi applications.

Critical Security Updates Released

On October 21, the PHP development team released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address the two security vulnerabilities. The releases span PHP's actively maintained version branches, meaning operators on each supported branch have a corresponding fixed version available.

SlowMist has urged cryptocurrency companies to review the PHP versions running on their servers, prioritizing systems that are accessible over the internet, and to install the security updates promptly.

The PHP developers added that relying solely on access restrictions or temporary security measures is insufficient, and that applying the relevant patches is essential for comprehensive protection.

*This is not investment advice.