Changpeng Zhao stated that exploitation cases involving PHP vulnerabilities have occurred, reminding users to exercise caution when visiting websites over the next few days.
Article
Changpeng Zhao warns: Exercise extra caution when visiting any website over the next few days
PANews October 22 reported that Binance founder Changpeng Zhao (CZ) posted on X that PHP was disclosed to have vulnerabilities (CVE-2026-109618、CVE-2026-109619), affecting servers running applications such as WordPress、Magento. Vulnerability details were leaked before patches were released, and the patches were released on October 21. Confirmed cases of exploitation emerged shortly after the leak. Attackers require no authentication to turn affected websites into tools for stealing visitors' credentials or attacking their devices.IT The WAF team is deploying protection through a web application firewall and installing patches. Changpeng Zhao reminded users to exercise extra caution when visiting any website over the next few days.
According to PANews, Binance founder Changpeng Zhao (CZ) posted the relevant warning on X.
02
The post states that PHP was disclosed to have vulnerabilities:CVE-2026-109618 and CVE-2026-109619。
03
The post states that these vulnerabilities affect servers running applications such as WordPress、Magento.
04
The post states that vulnerability details were leaked before patches were released, and that the patches were released on October 21.
05
The post states that confirmed cases of vulnerabilities being exploited emerged shortly after the leak.
06
The post states that attackers require no authentication to turn affected websites into tools for stealing visitors' credentials or attacking their devices.
07
The post states that the IT team is deploying WAF protection and installing patches.
08
Changpeng Zhao reminded users to exercise extra caution when visiting any website over the next few days.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
The reported risk is that servers running certain related applications may be affected by PHP vulnerabilities. Attackers can exploit affected websites without logging in, thereby stealing visitors' credentials or attacking their devices. The post states that the relevant team is providing protection through a web application firewall and patch installation.
Why it matters to readers
If users visit affected websites that have been exploited, their login credentials or devices may face security risks; website operators need to focus on deploying protections and installing patches.
Exercise heightened vigilance when visiting websites recently, and monitor security notices issued by website operators or relevant software providers.
Risks and unknowns
The original text is PANews' retelling of Changpeng Zhao's post and does not provide PHP an official announcement or confirmation from an independent security organization.
The original text does not specify the affected PHP versions, the precise scope of impact, or the severity of the vulnerabilities.
The original text does not provide the number, targets, or technical evidence of confirmed exploitation cases.
The original text does not state whether WAF protection can completely prevent the relevant attacks.
Related Developments
Loading event timeline…
Related concepts
PHP
This term is not in the glossary yet. Browse related concepts in the glossary.
