Binance founder Changpeng Zhao has warned cryptocurrency users to exercise extra caution when visiting websites over the coming days after two critical vulnerabilities were discovered in PHP, a programming language used by millions of websites worldwide.
Summary
- Binance founder Changpeng Zhao has urged cryptocurrency users to be cautious when visiting websites following the discovery of two critical PHP vulnerabilities.
- The vulnerabilities could allow attackers to execute malicious code on affected servers, including those running popular platforms such as WordPress and Magento.
- PHP developers released emergency security patches on October 21 after details of the vulnerabilities leaked before their planned disclosure.
- Security researchers have detected exploitation attempts, although no confirmed incidents affecting cryptocurrency exchanges or user wallets have been directly linked to the flaws.
In an October 22 warning, Zhao pointed to two security flaws identified as CVE-2026-109618 and CVE-2026-109619, which could allow attackers to execute malicious code on vulnerable web servers without requiring authentication.
“Call me paranoid, but be extra careful visiting ANY web site in the next few days,” Zhao wrote, explaining that some website administrators may not have installed the latest security patches.
The vulnerabilities affect PHP installations supporting popular content management and ecommerce platforms, including WordPress, Magento, Drupal and Joomla. Successful exploitation could allow attackers to compromise website infrastructure, access sensitive information or modify content served to visitors.
Although Zhao’s warning was directed at website users, the underlying vulnerabilities affect servers and do not mean that visiting any PHP-based website automatically compromises a person’s device or cryptocurrency wallet.
PHP vulnerabilities allow attackers to execute code remotely
According to the PHP Foundation’s security disclosure, both vulnerabilities received severity scores of 9.2 out of 10 and involve weaknesses in the programming language’s memory management and error handling systems.
The first vulnerability, CVE-2026-109618, involves memory corruption when PHP reaches its configured memory limit during certain operations. Under specific conditions, the server can incorrectly process partially initialized data, allowing an attacker to execute unauthorized code.
Meanwhile, CVE-2026-109619 concerns internal memory references that remain accessible after the associated memory has been released. Researchers demonstrated that attackers could exploit the weakness to execute code against applications running on affected servers.
The foundation confirmed that exploitation was possible under default configurations of Apache servers using mod_php, while researchers demonstrated additional attack paths involving PHP-FPM.
Following the disclosure, developers released patched versions PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on October 21.
The official PHP advisory urged administrators to update immediately, warning that temporary protections could not completely eliminate the risk.
Older PHP installations remain a concern because versions outside the project’s supported branches may depend on security fixes supplied separately by hosting providers or software vendors.
Emergency patches have been released
Details surrounding the vulnerabilities began circulating before the PHP security team completed its planned disclosure process.
According to the foundation, the two vulnerability identifiers appeared on online forums and social media on October 20, accompanied by an incorrect severity score of 10.0 and an inaccurate release schedule.
Although the initial leak did not contain technical exploit instructions, security company Calif subsequently published a proof of concept video by mistake, demonstrating attacks against several targets.
Copies continued circulating after the original video was removed, prompting researchers to develop additional exploit demonstrations.
The PHP team subsequently moved its scheduled security release forward from October 22 to October 21, giving software distributors time to prepare updates while reducing the period during which technical information could circulate without patches being available.
The foundation separately criticized security supplier Chainguard for publishing patched software images more than six hours before the coordinated release, potentially allowing attackers to examine the changes ahead of public disclosure.
Security company Cloudflare deployed firewall protections before the vulnerabilities became public, working alongside researchers from OpenAI, Wiz and other organizations involved in the disclosure.
Cloudflare said the vulnerabilities, collectively called PHP2Shell, could expose affected servers to remote code execution, service disruption and sensitive data exposure.
Crypto users at risks from compromised websites?
Zhao’s warning comes as cryptocurrency users continue to face phishing campaigns that rely on fraudulent websites and deceptive requests for wallet credentials.
Last week, crypto.news reported that fake Ledger websites had appeared in Google search results, with attackers attempting to collect wallet recovery phrases through pages impersonating legitimate software.
Another incident saw attackers using Trezor phishing emails and compromised third-party infrastructure to distribute fraudulent security messages to cryptocurrency customers.
However, a compromised PHP server could potentially allow attackers to alter website content or introduce fraudulent login and wallet connection requests, depending on the access obtained.
As of press time, there have been no confirmed reports of security incidents affecting cryptocurrency exchanges or user wallets directly linked to the newly disclosed PHP vulnerabilities.
The Canadian Centre for Cyber Security has urged organizations operating internet-facing PHP applications to identify vulnerable installations and apply the available security updates immediately.
Be the first to comment