SlowMist says the two PHP high-severity vulnerabilities may affect Web3 off-chain infrastructure

Article

⚡️SlowMist PHP Vulnerability report: affecting Web3 off-chain infrastructure, projects should immediately upgrade to the latest version

BlockBeats reports that October 23, the SlowMist security team released PHP in-depth analysis report on high-severity vulnerabilities, stating that PHP two high-severity vulnerabilities recently disclosed are posing systemic risks to the Web3 industry's “off-chain components.” The vulnerability identifiers are CVE-2026-109618 and CVE-2026-109619，CVSS v4.0 scores both reached 9.2 points, constituting critical-severity vulnerabilities. Attackers do not need an account password or API Key; they only need to send crafted requests to PHP services exposed to the public internet, potentially enabling arbitrary code execution with the privileges of the Web service process.

SlowMist stated that the vulnerabilities affect all versions from PHP 5.4 to 8.5.11, and that vulnerability details were leaked before the official patches were released. The Amazon threat intelligence team observed actual exploitation attempts 4 days before public disclosure. Scans by SlowMist's threat intelligence system MistEye showed that, among the 1488 cryptography-related domains included in its statistics, 793 had a direct PHP fingerprint, accounting for approximately 53.3%. This means that the front-end pages,Web3 interfaces, airdrop claim pages, operational backends, hosted wallet services, and other off-chain infrastructure of numerous API projects may be running in affected PHP environments.

SlowMist specifically warned that Web3 security cannot focus solely on on-chain contracts. If attackers exploit the PHP vulnerability to compromise a project's website server, they can tamper with front-end pages and induce users to sign malicious transactions, thereby directly stealing assets. Even if an on-chain contract has no vulnerabilities, that does not mean the off-chain components operating around the contract are secure.

For remediation, the official releases are versions PHP 8.5.12、8.4.27、8.3.36 and 8.2.35; relevant projects should upgrade immediately. Versions PHP 8.1 and earlier have ceased receiving regular upstream support and should be migrated as soon as possible. SlowMist also cautioned that when immediate upgrading is not possible, temporary mitigation measures can only reduce the risk of specific attack paths; applying the patches remains the complete solution.

Original link https://m.theblockbeats.info/flash/373322

Key points

The SlowMist security team released an PHP in-depth analysis report on high-severity vulnerabilities.
The vulnerability identifiers are CVE-2026-109618 and CVE-2026-109619，CVSS v4.0 scores are 9.2 points.
The report says attackers do not need an account password or API Key. After sending crafted requests to publicly exposed PHP services, they may execute arbitrary code with the privileges of the Web service process.
The report says the vulnerabilities affect all versions from PHP 5.4 to 8.5.11, and that vulnerability details were leaked before the official patches were released.
The report says the Amazon threat intelligence team observed actual exploitation attempts 4 days before public disclosure.
Among the 1488 cryptography-related domains counted by MistEye, 793 had a direct PHP fingerprint, accounting for approximately 53.3%。
The official releases are PHP 8.5.12、8.4.27、8.3.36 and 8.2.35;PHP 8.1 and earlier versions have ceased receiving regular upstream support.

AI-assisted interpretation

The following is analysis, separate from reported facts. Verify important claims independently.

PHP is server-side software used by many websites and interfaces. The report says that affected publicly exposed PHP services may allow attackers to execute code; if a project's website server is compromised, front-end pages may be tampered with and users may be induced to sign malicious transactions.

Why it matters to readers

Web3 Project security depends not only on on-chain contracts, but also on off-chain infrastructure such as websites,API, airdrop pages, backends, and hosted wallets. Projects running affected PHP versions need to focus on upgrading and migration.

The project websites and claim pages users see may depend on off-chain servers. After a server is compromised, page content may be untrustworthy, and users should exercise caution when connecting wallets or signing transactions.

Risks and unknowns

The provided materials do not include PHP official announcements or independent exploitation verification links.
It cannot be confirmed based solely on the materials whether the specific Web3 project uses the affected PHP version.
It cannot be confirmed based solely on the materials whether the specific project has been exploited.
It cannot be confirmed whether actual exploitation attempts observed before public disclosure targeted cryptography-related services.

SlowMist says the two PHP high-severity vulnerabilities may affect Web3 off-chain infrastructure

Article

AI-assisted interpretation

Why it matters to readers

Risks and unknowns

Related Developments

Related concepts

Keep following

Security Center