SlowMist Warns Bitcoin (BTC) Platforms of PHP Flaws Scoring 9.2 Out of 10

Update 23:56 UTC: An analysis of public-key visibility finds 6.04 million Bitcoin (BTC), 30.2% of issued supply, sits in outputs whose public keys are already exposed on-chain, leaving them theoretically open to a future quantum attacker running Shor's algorithm.

SlowMist Flags Two Critical PHP Flaws

Blockchain security firm SlowMist has issued a critical warning that reaches every major custody point in the Bitcoin (BTC) ecosystem, covering centralized exchanges, wallet providers and Bitcoin DeFi platforms that run online servers. The firm identified two vulnerabilities in PHP, the server-side language behind roughly seven in ten of the world's websites, and placed both at the top of the severity scale. The flaws, catalogued as CVE-2026-109618 and CVE-2026-109619, each score 9.2 out of 10 under the CVSS 4.0 framework, the standard security teams use to rank how dangerous a bug is. Under certain conditions, an attacker can execute malicious code on a vulnerable server without any authentication at all, which strips away the most basic gate a server normally has. The first flaw stems from how PHP manages situations where a server runs short of memory; the second involves memory data that has lost its validity between server requests yet can still be read. Successful exploitation, the advisory states, could let an attacker interfere with server infrastructure and reach sensitive data, a prospect the firm ranks as especially serious for platforms that handle user accounts and financial transactions around the clock. SlowMist said its MistEye threat intelligence system launched a global scan of PHP-based infrastructure across the crypto sector as soon as the flaws became public, sweeping exchanges that serve Bitcoin (BTC) and every major altcoin, wallet backends and related services. The exposure also reaches off-chain components: cross-chain bridges that hold BTC on one network and issue assets on another run exactly the always-on server stacks these bugs target. The advisory draws one boundary that matters. The Bitcoin network itself does not run PHP, so nothing in the report touches the Bitcoin price or the protocol's settlement rules; the risk sits with the companies and services that custody user coins.

New reporting on the disclosure, now widely tagged "PHP2Shell," adds evidence that exploitation attempts are already underway: Cloudflare warned that attackers have tried the flaws against its customers, and European government sites were temporarily taken offline as a precaution. Wiz Research said successful intrusions could expose passwords, authentication tokens and API keys. The risk assessment singles out three crypto categories: PHP-based payment gateways with WooCommerce integrations (Binance Pay, Crypto.com Pay, BitPay, CoinGate and CoinPayments are named), smaller exchanges running PHP account or payment systems, and DeFi and wallet websites whose frontends could be altered to show fake addresses or push malicious transaction approvals. No confirmed compromise of the named providers or major exchanges has been documented. Kraken carries lower exposure after completing its move of core backend infrastructure from PHP to Rust in 2025.

Separate on-chain research published the same day adds another custody-related data point for Bitcoin (BTC) holders, though it concerns quantum exposure rather than the PHP flaws. An analysis of public-key visibility finds 6.04 million BTC, 30.2% of issued supply, sits in outputs whose public keys are already exposed on-chain, leaving them theoretically open to a future quantum attacker running Shor's algorithm. Operational exposure accounts for 4.12 million coins, 2.1 times the 1.92 million classified as structurally exposed by script type. Exchange custody is the largest single component at 1.63 million coins, 40% of the operationally exposed total. Institution-level figures vary widely: Binance's publicly tagged holdings show 85% exposure and Bitfinex 100%, against Coinbase at 5% and sovereign treasuries at 0%.

PHP Patches Ship Oct. 21

Developers of PHP released fixes for both vulnerabilities on Oct. 21, shipping patched builds 8.5.12, 8.4.27, 8.3.36 and 8.2.35 across the four supported branches. All four builds carry the same two fixes, so administrators do not need a version migration to close the holes, only an in-branch upgrade to the patched release, and no supported PHP version line is left without a fix. The language's maintainers paired the patches with an operational warning of their own: access restrictions and temporary mitigations are not sufficient on their own, and applying the updates is mandatory for comprehensive protection. SlowMist echoed that position and gave companies across Bitcoin infrastructure a concrete checklist. The firm urged operators to inspect which PHP versions run on their servers, to prioritize systems reachable from the open internet, and to install the security updates without delay. The sequencing matters because exposure is not uniform across the sector. An exchange's public-facing API gateway presents a wider attack surface than an internal reporting tool, and the MistEye scan was built to map exactly that distinction: which crypto services expose PHP to the internet and which do not. The firm's guidance treats internet-reachable systems as the first patching priority, with everything else following in order of reachability. Exploitation of an unpatched server, on the advisory's framing, could compromise the infrastructure behind user balances and transaction processing, which is why the response window is measured in days rather than weeks. For platforms that custody Bitcoin, the version numbers give compliance teams a simple audit line: any server still running a build older than 8.2.35 in its branch needs attention before the next working session ends.

Custody, Not the Bitcoin Network

Our reading of the disclosure: the danger to a holder's coins runs through third-party servers, not the Bitcoin protocol, and self-custody users sit outside the blast radius. Bitcoin mining operators also fall outside the immediate scope, since mining infrastructure does not depend on PHP web stacks. The assets most exposed are custodial instruments, Wrapped Bitcoin tokens chief among them, because their backing depends on issuer servers staying uncompromised. Markets have so far treated the disclosure as operational rather than directional; Bitcoin hit a weekly high near $85K in its October rebound earlier this month. Traders tracking whether the story dents sentiment can follow our Bitcoin technical analysis. For the risk to land, one precondition must hold: an unpatched, internet-facing PHP server at a crypto platform has to be found and exploited before its operator installs the Oct. 21 fixes.