SlowMist Warns of Web3 Risks Due to PHP Vulnerabilities

Specialists from SlowMist have identified risks for Web3 projects due to PHP vulnerabilities. According to the MistEye monitoring system, PHP is used on 793 out of 1488 checked domains in the crypto industry, which accounts for about 53.3%. SlowMist emphasizes that this only indicates the use of PHP and does not imply that the websites are vulnerable or have been compromised.

According to the report, attackers can use compromised server control to replace the contract address or recipient of funds, leading to the user signing a malicious operation. They can also steal passwords and access keys, increasing the risk of fund loss, especially if access to hot wallets or signing services becomes possible. The scale of consequences is much more severe with insufficient data isolation and broad web server permissions. SlowMist recommends isolating asset management systems from web infrastructure and limiting the privileges of each component.

Vulnerabilities CVE-2026-109618 and CVE-2026-109619 are related to memory handling in PHP. Fixes were released on October 21 for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Temporary access restrictions and configuration changes can reduce risks but do not replace the necessary system update. Amazon recorded an attempted attack on October 17 in its MadPot honeypot network, but the success of such attacks on real systems remains unclear at the time of reporting.

SlowMist noted that the vulnerability does not affect all server environments, and not all user wallets are at risk. To protect themselves, users are advised to check addresses and permissions before signing, and to beware of false offers of "compensation" and "asset migration." It is reminded that on October 17, Google, Mozilla, Apple, and Microsoft also took emergency measures after discovering vulnerable certificates from the Indian certification authority eMudhra.