CZ warned crypto users to be cautious after two PHP vulnerabilities, each rated 9.2 out of 10, were disclosed. PHP released patches on October 21, while cybersecurity agencies urged organizat
Binance founder Changpeng Zhao has urged cryptocurrency users to be cautious when visiting websites after two critical vulnerabilities were discovered in PHP, a programming language widely used to build websites and online applications.
In a warning posted on October 21, Zhao pointed to the flaws, identified as CVE-2026-109618 and CVE-2026-109619, and cautioned that website administrators may not have installed the latest security updates.
Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches. Two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) reported for PHP, the web programming language, affecting servers running popular apps like WordPress and Magento, with patches released October 21, 2026 after details leaked early. Exploitation was confirmed in the wild soon after disclosure, prompting quick WAF protections and patching by IT teams, as unauthenticated attacks could turn visited sites into vectors for credential theft or device exploits. Stay SAFU!
— CZBNB (@cz_binance) October 21, 2026
The vulnerabilities carry a severity score of 9.2 out of 10 and could allow attackers to execute malicious code on affected servers without authentication. This could give attackers access to server files or databases and allow them to alter website content.
The PHP development team released security updates on October 21, urging administrators to update their systems immediately. The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
According to the official PHP advisory, one vulnerability involves memory corruption when the system runs out of memory, while the other involves internal data remaining accessible after its memory has been released. Both flaws can potentially allow remote code execution under affected configurations.
The security concerns have prompted warnings from government cybersecurity agencies. The European Union Agency for Cybersecurity and other European bodies urged organizations to identify affected systems and apply the available patches. New Zealand’s National Cyber Security Centre also reported awareness of active exploitation.
For cryptocurrency users, the concern is that attackers who compromise a website could potentially modify its content or insert fraudulent wallet connection prompts and login pages. However, the flaws primarily affect website servers; visiting a PHP-powered website does not automatically compromise a visitor’s device or crypto wallet.
The PHP team said updating is the only complete fix. Administrators running older, unsupported PHP versions may need to upgrade or obtain appropriate fixes from their software providers.
As of October 22, reports of exploitation had emerged, but no confirmed incident directly linking these vulnerabilities to a cryptocurrency exchange breach or user wallet losses had been established in the sources reviewed.
