Unattributed: Smart-contract vulnerability

PHP released fixes on Oct. 21 for two critical vulnerabilities that can let unauthenticated attackers run code on web servers, as crypto security executives urged operators to patch and check overlooked infrastructure. The PHP team's security advisory identifies CVE-2026-109618 and CVE-2026-109619, following its Oct. 20 advance warning. Both have a critical CVSS v4.0 severity score… Read the full story on CryptoSlate Understand the crypto stories that matter and what to watch next. Get The Catalyst in your inbox

Evidence boundary

Confidence describes the coverage of the available evidence. It is not a safety rating and does not guarantee that a protocol or asset is safe.

Sources

• https://cryptoslate.com/crypto-security-chiefs-sound-alarm-as-php-emergency-patch-scrambles-devs-worldwide/

Record history

First seen: 2026-10-21T17:00:04.000Z. Last updated: 2026-10-21T18:14:14.212Z. Revision: 1.