News linked to both this project and an event.
Odaily reports: The SlowMist security team has released a report stating that two recently disclosed high-severity PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are posing risks to the off-chain infrastructure of the Web3 industry. Both vulnerabilities have a CVSS v4.0 score of 9.2. Attackers do not need an account password or API key—simply sending a crafted request to a PHP service exposed to the public internet may allow them to execute arbitrary code with the privileges of the web service process.The vulnerabilities affect all versions of PHP from 5.4 to 8.5.11, and details of the flaws leaked before the official patches were released. Amazon's threat intelligence team observed actual exploitation attempts 4 days before public disclosure. Scanning by SlowMist's threat intelligence system MistEye shows that among 1,488 crypto-related domains surveyed, 793 carry direct PHP fingerprints, accounting for approximately 53.3%.Affected off-chain infrastructure includes Web3 project frontend pages, API interfaces, airdrop claim pages, operations backends, and custodial wallet services. If attackers exploit the PHP vulnerabilities to compromise a project's web server, they may tamper with frontend pages and trick users into signing malicious transactions, thereby stealing assets.Official releases of PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 have been published, and affected projects should upgrade to the corresponding latest versions. PHP 8.1 and earlier versions have reached end-of-life for upstream regular support and should be migrated as soon as possible. Temporary mitigation measures taken when an immediate upgrade is not possible can only reduce the risk of specific attack paths; applying the patch remains the definitive solution.
in its Q2 2026 Security and Compliance Report, Hacken stated that institutional investors are expanding their due diligence scope from smart contract audits to continuous monitoring, signer control, and incident response preparedness. Among the 1,427 projects it tracked, only 9% had third-party monitoring, and 4% had monitoring, active bug bounties, and security audits simultaneously. The report shows that of the approximately $764 million stolen in Q2, 88.3% involved compromised keys, signers, and infrastructure.Hacken noted that 14 projects attacked in Q2 had previously completed audits, but most of the losses originated from areas outside the scope of traditional smart contract reviews. The report states that the affected components included signing devices, cross-chain bridge validators, backend infrastructure, admin keys, and deprecated but still active old contracts. The sample covered 1,427 projects with a market cap exceeding $1 million, listed among the top 50 centralized exchanges on the CoinGecko Trust Score, excluding wrapped assets, stablecoins, and tokenized real-world assets.