Binance founder Changpeng Zhao (CZ) issued a warning on October 21 urging users to exercise caution when visiting websites following the early leak and active exploitation of two severe PHP vulnerabilities. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, carry a severity rating of 9.2 and permit unauthenticated remote attacks capable of stealing credentials or compromising visiting devices.
Premature Leak and Federal Security Warnings
Details regarding the security flaws began circulating online on October 20 with incorrect release timelines and an overstated severity score of 10.0. Security firm Calif mistakenly published a proof-of-concept video, while Chainguard released patch images more than six hours ahead of schedule. Although the PHP Foundation noted no functional exploits existed at initial disclosure, CZ confirmed active attacks in the wild shortly after details emerged, stating: "Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches."
In response, NSA Cyber advised organizations to prepare updates or take affected PHP systems offline immediately. The FBI's cyber division reiterated the offline recommendation and cautioned operators to monitor for unexpected PHP processes launching command shells. Meanwhile, Cloudflare activated default firewall protections prior to public disclosure. This alert follows prior security updates involving CZ regarding technological threats across the ecosystem.
Crypto Platforms Confirm Immunity
Key infrastructure projects moved quickly to reassure users regarding their technical exposure:
- BNB Chain: Executive Nina Rong confirmed that the network's technology stack does not utilize PHP.
- PancakeSwap: The decentralized exchange announced that PHP is completely absent from its infrastructure and user funds are safe.
- OpenAI: Revealed its AI models identified the bugs ahead of attackers via its Patch the Planet initiative, calling the flaw "one of the most impactful vulnerabilities in recent memory."
Responding to PancakeSwap's update, CZ noted that most projects should post similar official status confirmations. Ethereum co-founder Vitalik Buterin has previously noted that advanced AI tools could assist in proving program security, even as AI capabilities alter the cybersecurity landscape.
Why It Matters
This incident highlights the systemic risk posed by unauthenticated zero-day vulnerabilities in foundational web infrastructure like PHP. Because these flaws allow arbitrary exploits simply by visiting an unpatched site, cryptocurrency traders and decentralized application users face heightened exposure to credential theft and session hijacking. Web administrators must apply immediate patches or isolate vulnerable systems to prevent unauthorized command execution.
