Two Actively Exploited PHP Flaws Put Crypto Platforms on Alert
Photo: TokenPost
SlowMist warned crypto exchanges, decentralized finance (DeFi) platforms and wallet providers to patch two PHP vulnerabilities that attackers are actively exploiting. The flaws can let intruders run code on vulnerable servers without logging in. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each carry a 9.2 score under CVSS v4.0 and are classified as critical. The no-login condition means an attacker does not need an account on an affected system before attempting an exploit. Code execution means the vulnerable server can be made to run code. PHP released fixes on Oct. 21, including version 8.5.12.
Source: TokenPost
