CZ Warns of Active Exploitation of Two PHP Vulnerabilities

Binance founder CZ says attackers have exploited two PHP vulnerabilities that may expose website visitors' credentials or devices, and urged extra caution online for several days.

The flaws carry the identifiers CVE-2026-109618 and CVE-2026-109619. They may affect servers running applications such as WordPress and Magento. Details of both vulnerabilities leaked before patches were released, with fixes available Oct. 21.

CZ said cases of confirmed exploitation emerged soon after the details leaked. The attack requires no authentication, meaning attackers do not need a login to exploit an affected website. Through those sites, they can steal credentials belonging to visitors or target the visitors' devices. The warning reaches website visitors even though the vulnerabilities may affect the servers hosting applications.

IT teams are deploying web application firewalls (WAFs) and installing patches. CZ urged people to be especially cautious on any website for the next several days, while those protections and updates are being put in place.