Security researchers at SlowMist have issued a warning regarding critical PHP vulnerabilities, specifically CVE-2026-109618 and CVE-2026-109619. These flaws, related to memory handling, allow for remote code execution without authentication. The company's MistEye monitoring system identified that 793 out of 1,488 analyzed crypto industry domains, or approximately 53.3%, utilize PHP.
The report highlights that compromised servers could allow attackers to manipulate contract addresses, recipient details, or token spending permissions, leading users to sign malicious transactions. Additionally, attackers may steal API keys and credentials. Amazon reported detecting an attempted attack on its MadPot honeypot network on October 17.
Developers released patches on October 21 in PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. SlowMist advises projects to isolate asset management systems from web infrastructure and restrict server permissions. Users are encouraged to verify transaction details and permissions before signing, while remaining cautious of fraudulent compensation or migration offers.
