SlowMist Warns Bitcoin (BTC) Platforms of PHP Flaws Scoring 9.2 Out of 10

SlowMist Flags Two Critical PHP Flaws

Blockchain security firm SlowMist has issued a critical warning that reaches every major custody point in the Bitcoin (BTC) ecosystem, covering centralized exchanges, wallet providers and Bitcoin DeFi platforms that run online servers. The firm identified two vulnerabilities in PHP, the server-side language behind roughly seven in ten of the world's websites, and placed both at the top of the severity scale. The flaws, catalogued as CVE-2026-109618 and CVE-2026-109619, each score 9.2 out of 10 under the CVSS 4.0 framework, the standard security teams use to rank how dangerous a bug is. Under certain conditions, an attacker can execute malicious code on a vulnerable server without any authentication at all, which strips away the most basic gate a server normally has. The first flaw stems from how PHP manages situations where a server runs short of memory; the second involves memory data that has lost its validity between server requests yet can still be read. Successful exploitation, the advisory states, could let an attacker interfere with server infrastructure and reach sensitive data, a prospect the firm ranks as especially serious for platforms that handle user accounts and financial transactions around the clock. SlowMist said its MistEye threat intelligence system launched a global scan of PHP-based infrastructure across the crypto sector as soon as the flaws became public, sweeping exchanges that serve Bitcoin (BTC) and every major altcoin, wallet backends and related services. The exposure also reaches off-chain components: cross-chain bridges that hold BTC on one network and issue assets on another run exactly the always-on server stacks these bugs target. The advisory draws one boundary that matters. The Bitcoin network itself does not run PHP, so nothing in the report touches the Bitcoin price or the protocol's settlement rules; the risk sits with the companies and services that custody user coins.

PHP Patches Ship Oct. 21

Developers of PHP released fixes for both vulnerabilities on Oct. 21, shipping patched builds 8.5.12, 8.4.27, 8.3.36 and 8.2.35 across the four supported branches. All four builds carry the same two fixes, so administrators do not need a version migration to close the holes, only an in-branch upgrade to the patched release, and no supported PHP version line is left without a fix. The language's maintainers paired the patches with an operational warning of their own: access restrictions and temporary mitigations are not sufficient on their own, and applying the updates is mandatory for comprehensive protection. SlowMist echoed that position and gave companies across Bitcoin infrastructure a concrete checklist. The firm urged operators to inspect which PHP versions run on their servers, to prioritize systems reachable from the open internet, and to install the security updates without delay. The sequencing matters because exposure is not uniform across the sector. An exchange's public-facing API gateway presents a wider attack surface than an internal reporting tool, and the MistEye scan was built to map exactly that distinction: which crypto services expose PHP to the internet and which do not. The firm's guidance treats internet-reachable systems as the first patching priority, with everything else following in order of reachability. Exploitation of an unpatched server, on the advisory's framing, could compromise the infrastructure behind user balances and transaction processing, which is why the response window is measured in days rather than weeks. For platforms that custody Bitcoin (BTC), the version numbers give compliance teams a simple audit line: any server still running a build older than 8.2.35 in its branch needs attention before the next working session ends.

Custody, Not the Bitcoin Network

Our reading of the disclosure: the danger to a holder's coins runs through third-party servers, not the Bitcoin protocol, and self-custody users sit outside the blast radius. Bitcoin mining operators also fall outside the immediate scope, since mining infrastructure does not depend on PHP web stacks. The assets most exposed are custodial instruments, Wrapped Bitcoin tokens chief among them, because their backing depends on issuer servers staying uncompromised. Markets have so far treated the disclosure as operational rather than directional; Bitcoin hit a weekly high near $85K in its October rebound earlier this month. Traders tracking whether the story dents sentiment can follow our Bitcoin technical analysis. For the risk to land, one precondition must hold: an unpatched, internet-facing PHP server at a crypto platform has to be found and exploited before its operator installs the Oct. 21 fixes.