SlowMist PHP Vulnerability Report: Affects Web3 Off-Chain Infrastructure, Projects Should Immediately Upgrade to the Latest Version

BlockBeats news, October 23 — SlowMist Security Team released an in-depth analysis report on high-severity PHP vulnerabilities, stating that two recently disclosed high-risk PHP vulnerabilities are posing systemic risks to the "off-chain components" of the Web3 industry. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, both with CVSS v4.0 scores of 9.2, classified as critical severity. Attackers do not need an account, password, or API key — merely sending crafted requests to a PHP service exposed to the public internet may allow arbitrary code execution with the privileges of the web service process.

SlowMist stated that the vulnerabilities affect all versions of PHP from 5.4 to 8.5.11, and that vulnerability details were leaked before the official patches were released. Amazon's threat intelligence team observed actual exploitation attempts 4 days before public disclosure. Scanning by SlowMist's threat intelligence system MistEye showed that among 1,488 crypto-related domains it tracked, 793 carried direct PHP fingerprints, accounting for approximately 53.3%. This means that off-chain infrastructure of a large number of Web3 projects — including frontend pages, API endpoints, airdrop claim pages, operations backends, and custodial wallet services — may be running on affected PHP environments.

SlowMist specifically noted that Web3 security cannot focus solely on on-chain contracts. If attackers exploit the PHP vulnerabilities to compromise a project's web server, they can tamper with frontend pages and trick users into signing malicious transactions, thereby directly stealing assets. Even if on-chain contracts are free of vulnerabilities, that does not mean the off-chain components surrounding those contracts are secure.

Regarding remediation, the official releases of PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 have been published, and affected projects should upgrade immediately; PHP 8.1 and earlier versions have reached end of upstream regular support and should be migrated as soon as possible. SlowMist also reminded that temporary mitigations when immediate upgrades are not possible can only reduce the risk of specific attack paths — applying the patches remains the definitive solution.