SlowMist reported on 21 October 2026 two critical PHP remote code execution vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, according to the security firm's statements cited in Story A. The report was first published at 02:42:53 UTC that day. SlowMist is the primary source named for the identification of the two flaws. The story carries a Confirmed label, meaning a primary source, on-chain data or several independent outlets back it. [1]

SlowMist said its MistEye system conducted a global scan of PHP-related assets across the crypto industry and urged platforms to upgrade to patched versions. The firm's statements describe the scan as covering PHP-related assets specifically in the crypto sector. The claims do not state how many assets were scanned or what the scan found. The call to upgrade was directed at platforms, which SlowMist urged to move to patched versions once available. [2]

The Defiant reported that PHP's fixes were scheduled for 10 a.m. ET and that advisories urged operators to restrict exposed services. Later the same day, The Defiant reported that the NSA urged PHP users to patch or take systems offline. These reports describe scheduled fixes and official guidance rather than the vulnerabilities themselves. The claims do not give the number of systems affected or any details of the advisories beyond the quoted wording. [3] [4]

Decrypt reported that the patch is out and that attacks started early. Cointelegraph, in a report timestamped 00:44 UTC on 22 October 2026, reported that the PHP Foundation admitted a structural failure delayed a critical security fix. These accounts come from newswire outlets rather than from the PHP project directly in the material provided. The claims do not specify which fix was delayed or how long the delay lasted. [5] [6]

The material leaves several points unconfirmed or in tension. SlowMist's report described official patches as pending, while Decrypt reported the patch is out and The Defiant reported fixes scheduled for 10 a.m. ET. The claims do not reconcile these accounts or give a single confirmed release time. The extent of any exploitation, the number of affected platforms and the impact of the reported delay are not quantified in the claims, and no outcome is stated. [1] [3] [5] [6]