CoinMeta Data: SlowMist's Chief Information Security Officer, 23pds, stated in a post that php has exposed two serious remote code execution (RCE) vulnerabilities, with numbers cve-2026-109618 and cve-2026-109619. The severity scores for CVSS and v4.0 are both 9.2. Technical details, conditions for exploitation, and affected versions have not yet been officially confirmed. The official security update is expected to be released on October 21, 2026, at 14:00 UTC (22:00 Beijing time). SlowMist has conducted a risk scan of assets using php in the cryptocurrency industry and recommends that all platforms, DEFI, and wallets upgrade and undergo auditing.