Binance (@binance) co-founder Changpeng Zhao (@cz_binance) has urged users to be careful when visiting websites over the next few days, following the disclosure of two critical vulnerabilitie
Binance (@binance) co-founder Changpeng Zhao (@cz_binance) has urged users to be careful when visiting websites over the next few days, following the disclosure of two critical vulnerabilities in PHP, the programming language behind a large share of the web.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, affect servers running popular platforms including WordPress and Magento. Details of the vulnerabilities were leaked before the patch was released on October 21. In his post, Zhao said some website administrators are not always up to date with security patches, and told users to be extra careful visiting any website in the next few days.
Security firms describe both bugs as severe. Both carry a CVSSv4 score of 9.2 and can allow unauthenticated remote code execution with the web worker's privileges. According to Rapid7, CVE-2026-109618 can corrupt memory during out-of-memory handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests.
For ordinary users, the concern is indirect. Attackers can turn affected websites into tools for stealing visitors' credentials or attacking their devices, without authentication. That is relevant for crypto users who log in to exchanges, wallets and other services through a browser.
The exposure is large. Palo Alto Networks' Unit 42 said its Cortex Xpanse telemetry identified over 22.6 million exposed instances potentially vulnerable to both CVEs. Tenable reports that Amazon Threat Intelligence observed an exploitation attempt on October 17, four days before public disclosure, and that it says php2shell is now being broadly exploited in the wild.
On October 21, 2026, PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Google Cloud notes that the PHP project is not releasing fixes for PHP 8.1 or earlier, which have reached end of life. Site operators on those branches face extra risk and need other mitigations.
As of the latest reporting, no confirmed incidents involving crypto exchanges or user wallets have been reported. Still, the speed of patch adoption across the web will determine how long the risk lasts. Users can lower their exposure by avoiding unfamiliar sites, being wary of unexpected login prompts, and using hardware-based two-factor authentication where available. Website administrators should update PHP immediately.
Rapid7: CVE-2026-109618 and CVE-2026-109619 technical overview
Palo Alto Networks Unit 42: Threat brief on the PHP vulnerabilities
Tenable: php2shell FAQ on critical PHP remote code execution
