CZ Warns Crypto Users as Critical PHP Vulnerabilities Put Websites at Risk

Changpeng Zhao warned internet users to be careful when visiting websites for the next few days after two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were patched on October 21 following an early leak of details. Zhao, identified as Binance’s founder, said the flaws require no login to exploit, so a visited site could lead to stolen credentials or a compromised device. The PHP Foundation said the CVE numbers circulated October 20 with a severity score of 10.0 instead of 9.2; it also noted no functional exploits were found when the release went out, though Zhao said exploitation was confirmed afterward. NSA Cyber and the FBI advised organizations running PHP to update or take affected systems offline if immediate patching was impossible.