CZ Warns Crypto Users to Be “Extra Careful”: PHP Vulnerabilities Hit the Code Behind 70% of Websites

Binance founder Changpeng “CZ” Zhao told his followers on Wednesday, October 21, to be “extra careful” visiting any website for the next few days. Why? PHP rushed out fixes for two PHP vulnerabilities that let attackers take over web servers without logging in. Plenty of sites won’t patch this week. Some never will. The flaws, CVE-2026-109618 and CVE-2026-109619, have been nicknamed PHP2Shell. Each scores 9.2 out of 10 for severity, and the FBI’s Cyber Division told organizations that can’t update to take their systems offline. So what does a bug on someone else’s server mean for your crypto? Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches. Two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) reported for PHP, the web programming language, affecting servers… — CZ 🔶 BNB (@cz_binance) October 21, 2026 DISCOVER: Best Meme Coins to Buy in 2026 What Are the PHP Vulnerabilities, and Why Is Everyone Worried? They let a stranger run their own code on a website’s server with a single request, before the site’s own software even loads. PHP’s release notice urged all users to update to v...