CZ Says Attackers Exploited Critical PHP Flaws Used by Websites

Binance founder CZ urged people to use caution when visiting websites over the next few days, saying attackers had exploited two critical PHP vulnerabilities that may remain unpatched on some sites.

PHP fixed both flaws Oct. 21, listing them as CVE-2026-109618 and CVE-2026-109619. Details leaked before formal disclosure, and both vulnerabilities were later found in active exploitation.

Under specific conditions, the flaws can let attackers run malicious code remotely without logging in. That access could give them control of a vulnerable website server and increase the risk of user credentials being stolen.

PHP is widely used in web applications, including those built with WordPress and Magento. CZ warned some site administrators may not install security patches in time, leaving a window in which vulnerable servers remain exposed.

CZ’s warning covered the days after PHP released the fixes, when some administrators may not yet have patched affected sites.