SlowMist found PHP on 793 of 1,488 crypto domains as CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) put exchanges on alert.