PHP Flaws Knock on Crypto’s Backend Door: Two 9.2/10 CVEs Trigger Alert

Blockchain security company SlowMist has issued a critical security alert over two serious vulnerabilities discovered in the widely used PHP programming language. Identified as CVE-2026-109618 and CVE-2026-109619, the flaws could allow attackers to remotely execute code on vulnerable servers. Both received a risk score of 9.2 out of 10 on the CVSS 4.0 system, indicating a critical security threat.

The warning concerns cryptocurrency exchanges, decentralized finance (DeFi) platforms, and cryptocurrency wallet providers worldwide, bringing the infrastructure used by Bitcoin and Altcoins into focus. PHP is used by 70 percent of all websites.

According to SlowMist, the company’s MistEye threat intelligence system conducted a global scan of PHP-based infrastructures in the cryptocurrency sector following the discovery of the vulnerabilities. The statement did not disclose scan results or identify a specific exchange, DeFi platform, or wallet provider as compromised.