TL;DR
- Changpeng Zhao warned about two critical PHP vulnerabilities that could compromise web servers and expose user data.
- The flaws, identified as CVE-2026-109618 and CVE-2026-109619, were patched after information about them leaked ahead of schedule.
- BNB Chain and PancakeSwap confirmed that they do not use PHP in their infrastructure and said their systems are unaffected.
Changpeng Zhao (CZ), founder of Binance, warned about the risks of visiting websites that have not yet patched two critical PHP vulnerabilities. The flaws could allow unauthenticated attacks, potentially enabling credential theft or compromising visitors’ devices.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, affect servers running PHP, a programming language used by applications such as WordPress and Magento. Patches were released on October 21 after some technical information was disclosed earlier than planned.
Zhao urged users to exercise extra caution over the next few days, noting that some website administrators do not install security updates immediately.
Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches.
Two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) reported for PHP, the web programming language, affecting servers…
— CZ 🔶 BNB (@cz_binance) October 21, 2026
Zhao Warns About Attacks Exploiting PHP Security Flaws
According to Zhao, the vulnerabilities were confirmed to have been exploited in the wild shortly after their disclosure. Attackers could target unpatched servers to access sensitive information or compromise the devices of people visiting affected websites.
The U.S. National Security Agency (NSA) recommended updating affected systems or temporarily taking them offline if patches could not be applied immediately. The FBI also urged administrators to monitor PHP processes that unexpectedly execute system commands.
Cloudflare reported that it had enabled default firewall protections before the vulnerabilities were publicly disclosed.
BNB Chain and PancakeSwap Rule Out Exposure
Following the warning, BNB Chain and PancakeSwap confirmed that they do not use PHP in their systems, meaning their infrastructure would not be exposed to these vulnerabilities.
Nina Rong, a BNB Chain executive, said the programming language is not part of the network’s technology stack. PancakeSwap also confirmed that it does not use PHP and stated that user funds remain safe.
Zhao shared PancakeSwap’s statement and urged other projects to publish similar confirmations about their systems.
Meanwhile, OpenAI reported that its artificial intelligence models helped identify the vulnerabilities through its Patch the Planet initiative. The PHP Foundation explained that the premature disclosure included inaccurate information about the severity of the flaws.
