Crypto Security Alert: PHP Exploits, LiteLLM Backdoor And Next.js Bugs Demand Patching

Published by

Anjali Belgaumkar

October 21, 2026

Blockchain sleuth ZachXBT exposed Canadian Haby, who stole $2M from Coinbase users via social engineering, earning RCMP calls.

Blockchain security firm SlowMist has warned crypto exchanges, DeFi platforms and wallet providers to patch two critical PHP vulnerabilities that attackers are already exploiting. The flaws, CVE-2026-109618 and CVE-2026-109619, both carry a 9.2 CVSS v4.0 score and can let unauthenticated attackers run code on vulnerable servers. PHP released fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. SlowMist said its MistEye system scanned PHP assets across the crypto industry after the disclosure. The bugs are part of a broader string of incidents. LiteLLM version 1.107.0 was reportedly backdoored to steal cloud, SSH and AI credentials. Next.js has two critical bugs, PingCAP’s TiDB Cloud was breached, and zero-days in BeyondTrust and Ivanti are under active attack.

Trust with CoinPedia:

CoinPedia has been delivering accurate and timely cryptocurrency and blockchain updates since 2017. All content is created by our expert panel of analysts and journalists, following strict Editorial Guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Every article is fact-checked against reputable sources to ensure accuracy, transparency, and reliability. Our review policy guarantees unbiased evaluations when recommending exchanges, platforms, or tools. We strive to provide timely updates about everything crypto & blockchain, right from startups to industry majors.

Investment Disclaimer:

All opinions and insights shared represent the author's own views on current market conditions. Please do your own research before making investment decisions. Neither the writer nor the publication assumes responsibility for your financial choices.