Binance Founder Warns Of Critical PHP Security Flaws

Binance founder Changpeng Zhao has urged cryptocurrency users to exercise extra caution when visiting websites over the coming days after security researchers discovered two critical vulnerabilities in the PHP programming language.

The security flaws, identified as CVE-2026-109618 and CVE-2026-109619, carry severity scores of 9.2 out of 10. According to security disclosures, the vulnerabilities involve weaknesses in PHP's memory management and error handling systems. They could allow unauthenticated attackers to execute malicious code remotely on vulnerable web servers supporting popular platforms like WordPress, Magento, Drupal, and Joomla.

Emergency Patches Released

Emergency security patches were released by PHP developers on October 21 after details of the vulnerabilities leaked prematurely on online forums and social media. Security companies such as Cloudflare deployed firewall protections before the disclosures became public, while organizations including OpenAI and Wiz assisted in the response.

Although Zhao warned that some website administrators may not have installed the latest security updates, the underlying vulnerabilities affect server infrastructure rather than individual user devices. Security monitoring has detected exploitation attempts, but no confirmed incidents affecting cryptocurrency exchanges or user wallets have been directly linked to the flaws.

Key Facts

• Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were discovered with severity scores of 9.2 out of 10.
• Binance founder Changpeng Zhao urged cryptocurrency users to exercise caution when visiting websites over the coming days.
• Patched versions PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 were released on October 21.
• As of press time, no confirmed security incidents affecting crypto exchanges or user wallets have been directly linked to the flaws.