Changpeng Zhao Warns Cryptocurrency Users About Vulnerabilities in PHP

Binance founder Changpeng Zhao urged cryptocurrency users to be especially cautious when visiting websites in the coming days after two critical vulnerabilities were discovered in PHP – a language that powers about 70% of websites with known server-side languages. The vulnerabilities CVE-2026-109618 and CVE-2026-109619 allow attackers to execute malicious code on vulnerable servers without authentication.

On October 21, PHP developers released emergency patches after details leaked before the official disclosure. Fixes are available in PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The vulnerabilities affect PHP installations supporting WordPress, Magento, Drupal, and Joomla; successful exploitation allows compromising site infrastructure, accessing confidential data, or altering content for visitors.

According to the PHP Foundation, both vulnerabilities received a score of 9.2 out of 10 and are related to memory management and error handling flaws. The foundation urged administrators to update immediately, warning that temporary protections do not completely eliminate the risk. Older versions outside the supported branches depend on fixes separately provided by hosting providers and vendors.

In a warning dated October 22, Zhao wrote: “Call me paranoid, but be extremely cautious when visiting any site in the next few days” – some administrators, he noted, do not always install patches promptly. He also mentioned that exploitation was confirmed in real-world environments shortly after disclosure, which accelerated WAF-level protection and patching. However, the vulnerabilities affect servers, not visitor devices: visiting a PHP site does not automatically compromise a wallet.

The warning does not mean that every crypto platform is vulnerable. BNB Chain Executive Director Nina Rong confirmed that the network does not use PHP in its stack, and PancakeSwap reported that PHP is not used anywhere in its infrastructure and user funds are safe. Zhao reposted this statement with the comment: “Most projects should at least publish such confirmation.”