PHP Security Flaws Prompt Urgent Patch Alert for Crypto Platforms

Two critical vulnerabilities in PHP may let attackers execute code on affected servers, prompting an urgent security alert for crypto exchanges, decentralized finance (DeFi) platforms and wallet providers. The flaws are CVE-2026-109618 and CVE-2026-109619. Each carries a 9.2 score under CVSS v4.0. SlowMist's MistEye threat intelligence system identified the vulnerabilities and described them as critical. Remote code execution means an attacker can run code on a vulnerable server. PHP released security patches for several versions on Oct. 21, and the warning calls for crypto operators to apply relevant updates promptly.