From Coinpedia · By Anjali Belgaumkar
Blockchain security firm SlowMist has warned crypto exchanges, DeFi platforms and wallet providers to patch two critical PHP vulnerabilities that attackers are already exploiting. The flaws, CVE-2026-109618 and CVE-2026-109619, both carry a 9.2 CVSS v4.0 score and can let unauthenticated attackers run code on vulnerable servers. PHP released fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. SlowMist said its MistEye system scanned PHP assets across the crypto industry after the disclosure. The bugs are part of a broader string of incidents. LiteLLM version 1.107.0 was reportedly backdoored to steal cloud, SSH and AI credentials. Next.js has two critical bugs, PingCAP’s TiDB Cloud was breached, and zero-days in BeyondTrust and Ivanti are under active attack.
TagsCrypto news Show More Was this writing helpful?
Tell us why!
Story Ends Here Previous Article : XRP News Today: Bold $4 Call For November 30 Meets A Ceiling Tested Seven Times
Trust with CoinPedia:
CoinPedia has been delivering accurate and timely cryptocurrency and blockchain updates since 2017. All content is created by our expert panel of analysts and journalists, following strict Editorial Guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Every article is fact-checked against reputable sources to ensure accuracy, transparency, and reliability. Our review policy guarantees unbiased evaluations when recommending exchanges, platforms, or tools. We strive to provide timely updates about everything crypto & blockchain, right from startups to industry majors.
Investment Disclaimer:
All opinions and insights shared represent the author's own views on current market conditions. Please do your own research before making investment decisions. Neither the writer nor the publication assumes responsibility for your financial choices.
Sponsored and Advertisements:
Sponsored content and affiliate links may appear on our site. Advertisements are marked clearly, and our editorial content remains entirely independent from our ad partners.