All coins

WiretechnologyPublisher preview

PHP Unveils Critical “Internet-Wide” Vulnerabilities: How Can Web3 Patch Its “Off-Chain Weaknesses”?

What Happened On October 21, the PHP project released emergency security updates to fix two critical vulnerabilities, CVE-2026–109618 and CVE-2026–109619, which could lead to unauthenticated remote code execution (RCE). Both were rated 9.

SlowMistSlowMist · October 23, 2026 · 10d ago

Share

Key points

  • SlowMist reports PHP released emergency fixes on October 21 for CVE-2026–109618 and CVE-2026–109619, both rated 9.2 CVSS v4.0 and enabling unauthenticated remote code execution.
  • Versions 5.4 through 8.5.11 are affected, with patches in 8.5.12, 8.4.27, 8.3.36 and 8.2.35; Amazon observed exploitation attempts from October 17.
  • Of 1,488 crypto-related domains scanned by SlowMist's MistEye, 793 (about 53.3%) showed PHP fingerprints, which the article says does not imply compromise.

AI summary of SlowMist’s report, written only from the publisher’s text. Read the original for full context.

Read the full story

Continue reading at SlowMist

Headline and excerpt from SlowMist’s public feed. SlowMist holds the copyright and publishes the full story; Dextape links to it rather than reprinting it.

BinanceOKX

custody

Original reporting

SlowMist, SlowMist

SlowMist wrote and holds the copyright to this story. Dextape shows its headline and a short excerpt and links to the full piece.

Read it at SlowMist ↗

Share this story