CZ Warns Crypto Users as Critical PHP Vulnerabilities Put Websites at Risk

Changpeng Zhao (CZ) is telling internet users to be extra careful on any website for the next few days, after two PHP vulnerabilities were patched on October 21 when their details leaked early. Because attackers need no login to exploit them, a site someone simply visits could become a route to stolen credentials or a compromised device, CZ warned. In an October 21 post on X referring to vulnerabilities CVE-2026-109618 and CVE-2026-109619, Zhao wrote: NSA Cyber advised organizations running PHP to prepare for an update and to take the affected system offline if patching could not happen immediately.