CZ Warns Crypto Users as Critical PHP Vulnerabilities Put Websites at Risk
Binance CEO Changpeng Zhao warns users to be extra careful visiting websites after two critical PHP vulnerabilities were patched on October 21, with exploitation confirmed in the wild.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were patched on October 21 after their details leaked early. Because attackers can exploit them without login credentials, simply visiting a compromised website could lead to stolen credentials or device compromise, according to Zhao.
In an October 21 post on X, Zhao wrote: "Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches."
Confirmed Exploitation
The PHP Foundation reported that the CVE numbers began circulating online on October 20 with incorrect information, including a wrong release time and severity score. Despite no functional exploits being found initially, Zhao later confirmed that exploitation had been confirmed in the wild after disclosure.
Exploitation was confirmed in the wild soon after disclosure, prompting quick WAF protections and patching by IT teams, as unauthenticated attacks could turn visited sites into vectors for credential theft or device exploits.
Platform Responses
Not all cryptocurrency platforms are vulnerable. BNB Chain executive Nina Rong confirmed the network doesn't use PHP in its technology stack, while PancakeSwap posted that it doesn't use PHP anywhere in its infrastructure and user funds remain safe.
Zhao reposted PancakeSwap's statement, commenting that "Most projects should at least post a confirmation like this." Meanwhile, OpenAI stated its models helped researchers find the bugs through its Patch the Planet initiative, calling the bug "one of the most impactful vulnerabilities in recent memory."
Related
