CZ Warns Crypto Users as Critical PHP Vulnerabilities Put Websites at Risk

PancakeSwap and BNB Chain both say PHP is nowhere in their tech stacks, and CZ wants other projects to post the same kind of confirmation. Changpeng Zhao (CZ) is telling internet users to be extra careful on any website for the next few days, after two PHP vulnerabilities were patched on October 21 when their details leaked early. Because attackers need no login to exploit them, a site someone simply visits could become a route to stolen credentials or a compromised device, CZ warned. Exploitation Confirmed in the Wild In an October 21 post on X referring to vulnerabilities CVE-2026-109618 and CVE-2026-109619, Zhao wrote: “Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches.” NSA Cyber advised organizations running PHP to prepare for an update and to take the affected system offline if patching could not happen immediately. The FBI’s cyber division repeated the offline option and asked operators to watch for PHP processes that unexpectedly launch command shells. Cloudflare stated that it had switched on default firewall protections before the flaws became public. According to a PHP Fou...