SlowMist Urges Web3 Projects to Patch Two PHP Flaws Rated 9.2

SlowMist urged Web3 projects to patch two PHP vulnerabilities immediately, warning that attackers may be able to run code on publicly exposed servers and threaten off-chain crypto infrastructure. The flaws, CVE-2026-109618 and CVE-2026-109619, each have a CVSS v4.0 severity score of 9.2. An attacker without an account or API key could send a crafted request to an exposed PHP service and execute code with the privileges of its web server process. The vulnerabilities affect PHP versions 5.4 through 8.5.11. Details of the flaws leaked before official patches were released. Exploitation attempts were observed four days before public disclosure.