Binance Founder CZ Warns Crypto Users of Critical PHP Security Flaws Threatening Websites

In Brief:

Binance founder Changpeng Zhao has warned cryptocurrency users about two critical PHP vulnerabilities that could expose websites to cyberattacks. According to Zhao’s October 22 post, users should exercise caution when visiting websites because some administrators may have delayed security updates.

“Call me paranoid, but be extra careful visiting ANY website in the next few days,” Zhao wrote.

The warning concerns CVE-2026-109618 and CVE-2026-109619, two security flaws that allow attackers to execute malicious code without authentication. Both vulnerabilities carry severity scores of 9.2 out of 10, placing affected web servers at significant security risk.

PHP supports numerous websites built with WordPress, Magento, Drupal, and Joomla, making the vulnerabilities relevant across several online industries. Attackers exploiting vulnerable servers could access sensitive information, alter website content, or interfere with services used by cryptocurrency customers.

Also Read: Railway Halts Deployments Following Security Breach Involving Customer API Keys

Critical PHP Vulnerabilities Expose Websites to Remote Code Execution

The PHP Foundation disclosed both vulnerabilities on October 21, identifying weaknesses involving memory management and internal processing. CVE-2026-109618 involves memory corruption when PHP reaches its configured memory limit during specific operations.

Under certain conditions, attackers can exploit improperly initialized data to execute unauthorized commands within affected server environments. Meanwhile, CVE-2026-109619 involves memory references that remain accessible even when the system has already released their associated memory.

Security researchers demonstrated how attackers could exploit this weakness to execute malicious code against vulnerable applications. Researchers also confirmed exploitation under default Apache configurations using mod_php, alongside additional attack methods involving PHP-FPM.

These findings raised concerns about servers running outdated PHP installations, particularly those supporting websites handling sensitive customer information.

PHP Developers Release Emergency Security Updates Following Disclosure Leak

PHP developers released emergency security updates, addressing both vulnerabilities across four supported software branches. The patched releases include PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, with administrators urged to install the appropriate updates.

The PHP Foundation explained that information about the vulnerabilities appeared online before researchers completed the coordinated disclosure process. On October 20, social media discussions incorrectly assigned the flaws maximum severity scores and circulated inaccurate release information.

Security company Calif mistakenly published a proof-of-concept demonstration, exposing technical attack details before the planned announcement. Copies of the demonstration circulated online, increasing concerns about potential exploitation before administrators could install protective updates.

Developers later moved the scheduled release from October 22 to October 21 to release security patches earlier. Cloudflare also introduced firewall protections against the vulnerabilities, collectively identified as PHP2Shell, before their public disclosure.

The company collaborated with security researchers from OpenAI, Wiz, and other organizations involved in investigating the weaknesses.

Coldcard Bitcoin Wallet Users Targeted in Separate Phishing Attack

As reported by 36Crypto, Bitcoin hardware wallet manufacturer Coldcard recently warned users about a phishing attack involving its compromised official X account. On October 11, attackers published a fraudulent security announcement claiming that a critical firmware vulnerability affected several Coldcard hardware wallets.

The misleading warning specifically targeted owners of the Mk4, Mk5, and Q devices, directing them toward a fraudulent website. Attackers urged wallet owners to transfer their Bitcoin immediately, presenting the instructions as an urgent security measure.

Coldcard subsequently removed the fraudulent announcement and confirmed that unauthorized parties had gained access to its official social media account. The incident also raised concerns because attackers referenced an earlier vulnerability involving Coldcard hardware wallets to support their misleading claims.

Unlike the PHP vulnerabilities highlighted by Zhao, the Coldcard incident involved social media account compromise and fraudulent instructions targeting Bitcoin holders.

Website Administrators Urged to Install Security Patches

The PHP Foundation has urged website administrators to upgrade vulnerable installations because temporary security measures cannot eliminate every exploitation risk. Operators using unsupported PHP versions may require additional security fixes from their hosting providers or software vendors.

Zhao’s warning highlights security concerns surrounding compromised websites, particularly those handling cryptocurrency transactions and sensitive customer information. The emergency PHP updates address the identified server vulnerabilities, while Coldcard’s separate incident illustrates the risks of a fraudulent security breach.

Also Read: OCC Finalizes GENIUS Act Stablecoin Rules, Setting New Federal Oversight Standards