From CryptoPotato · By Wayne Jones
Changpeng Zhao (CZ) is telling internet users to be extra careful on any website for the next few days, after two PHP vulnerabilities were patched on October 21 when their details leaked early.
Because attackers need no login to exploit them, a site someone simply visits could become a route to stolen credentials or a compromised device, CZ warned.
Exploitation Confirmed in the Wild
In an October 21 post on X referring to vulnerabilities CVE-2026-109618 and CVE-2026-109619, Zhao wrote:
“Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches.”
NSA Cyber advised organizations running PHP to prepare for an update and to take the affected system offline if patching could not happen immediately. The FBI’s cyber division repeated the offline option and asked operators to watch for PHP processes that unexpectedly launch command shells. Cloudflare stated that it had switched on default firewall protections before the flaws became public.
According to a PHP Foundation blog post, the two CVE numbers began circulating online on October 20 with a wrong release time and a severity score of 10.0 instead of the real 9.2, though no technical details were out.
Calif, one of the firms that reported the bugs, then mistakenly published a proof-of-concept video, and Chainguard released patch images more than six hours ahead of the agreed time. Curiously, the foundation noted that no functional exploits had been found when the release went out, while CZ’s post describes attacks confirmed afterward.
“Exploitation was confirmed in the wild soon after disclosure, prompting quick WAF protections and patching by IT teams, as unauthenticated attacks could turn visited sites into vectors for credential theft or device exploits,” stated the Binance founder.
BNB Chain and PancakeSwap Say Their Systems Are Unaffected
The warning does not mean every cryptocurrency platform is vulnerable. BNB Chain executive Nina Rong confirmed that the network does not use PHP in its technology stack, while decentralized exchange PancakeSwap posted that it does not use PHP anywhere in its infrastructure and that user funds were safe.
Zhao subsequently reposted PancakeSwap’s statement, commenting that “Most projects should at least post a confirmation like this.”
Meanwhile, OpenAI stated that its models helped researchers find the bugs through its Patch the Planet initiative and called the bug “one of the most impactful vulnerabilities in recent memory.” To its knowledge, the company added, frontier AI got to the problem ahead of attackers.
Ethereum co-founder Vitalik Buterin has pushed the idea that AI hacking makes cybersecurity hopeless, reasoning that AI able to provide hard math theorems could also prove a program secure.