Critical PHP Flaws Put Web3 Off-Chain Infrastructure at Risk

Two critical PHP vulnerabilities could let attackers run code on exposed Web3 services, putting project websites and user-facing tools at risk even when their blockchain contracts are secure. The flaws are identified as CVE-2026-109618 and CVE-2026-109619, each with a CVSS v4.0 score of 9.2. The flaws affect PHP versions 5.4 through 8.5.11. An attacker would not need a login or API key; a crafted request to a publicly exposed PHP service could allow arbitrary code execution with the web process’s privileges. A scan of 1,488 crypto-related domains found direct PHP fingerprints on 793, or 53.3%.