Key Takeaways
- Former Binance CEO Changpeng Zhao advised crypto users to exercise heightened caution when browsing websites following the discovery of two severe PHP vulnerabilities.
- Both security flaws received a critical severity rating of 9.2 on a 10-point scale, enabling unauthorized code execution on vulnerable servers.
- Emergency security updates were issued by PHP on October 21 following premature disclosure of the vulnerabilities.
- Multiple government agencies across Europe and Australia temporarily disabled public-facing websites as a protective measure.
- Major crypto platforms Coinbase and BitGo confirmed their systems remained secure, with no cryptocurrency losses attributed to these vulnerabilities.
Changpeng Zhao, the founder of Binance, has issued a public warning to cryptocurrency holders about heightened online risks following the exposure of two significant security vulnerabilities in PHP. The programming language serves as the backbone for countless websites globally.
“Call me paranoid, but be extra careful visiting ANY web site in the next few days,” Zhao posted on October 22. His concern centered on the possibility that some site operators might delay implementing necessary security updates.
Identified as CVE-2026-109618 and CVE-2026-109619, these vulnerabilities create opportunities for malicious actors to execute unauthorized code on web servers without authentication credentials. Websites utilizing WordPress, Magento, Drupal, and Joomla platforms face potential exposure.
The vulnerabilities reside on the server side rather than client side. Simply browsing a PHP-powered website does not inherently compromise a user’s device or cryptocurrency wallet.
Technical Details of the Vulnerabilities
The PHP Foundation assigned both security flaws a critical severity rating of 9.2 on the Common Vulnerability Scoring System. The vulnerabilities stem from improper memory management and error-handling protocols.
One vulnerability triggers memory corruption when PHP reaches its allocated memory threshold. The companion flaw involves accessible memory remaining after deallocation. Cybersecurity firm Cloudflare designated this vulnerability pair as “PHP2Shell.”
On October 21, PHP distributed patched releases including versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The foundation issued urgent guidance for immediate implementation by system administrators.
Premature disclosure occurred October 20 when vulnerability details surfaced online with an inflated 10.0 severity rating. Security firm Calif inadvertently released demonstration footage of the exploit, prompting PHP developers to accelerate their patch timeline by 24 hours.
The foundation acknowledged initial detection of the underlying issue in 2024. It characterized the remediation delay as a “structural failure” resulting from inadequate decision-making frameworks and resource constraints.
A subsequent independent report from Calif and OpenAI on August 11 elevated the issue to critical priority status.
Global Response from Authorities and Cryptocurrency Organizations
Government cybersecurity teams worldwide implemented precautionary website shutdowns on Wednesday. The Netherlands suspended its digital identity verification platform, while Finland, France, and Germany took numerous public services offline temporarily.
Australia’s national cybersecurity portal experienced disruptions. Japan’s Prime Minister Sanae Takaichi issued public guidance urging immediate patch deployment across all vulnerable systems.
The Wikimedia Foundation disabled certain infrastructure services, resulting in intermittent Wikipedia accessibility issues.
Within the cryptocurrency sector, security firm SlowMist identified PHP signatures on 793 domains among 1,488 analyzed cryptocurrency-related websites. The firm issued advisories to exchanges, decentralized finance protocols, and wallet providers recommending urgent upgrades.
Intersect, a development organization supporting Cardano, temporarily suspended its Members Area portal pending vulnerability assessment. Coinbase reported zero exposed PHP installations across its infrastructure, while BitGo confirmed its platform remained unaffected.
Zhao’s advisory arrives amid escalating phishing campaigns targeting crypto users, including counterfeit Ledger sites appearing in sponsored search results. A compromised PHP server could enable attackers to manipulate website content or inject fraudulent wallet authentication prompts.
According to the PHP security team, no functional exploits had been verified at the time of public disclosure. Through the publication date, no confirmed security breaches at cryptocurrency exchanges or user wallet compromises have been traced to these vulnerabilities.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
