TLDR
- Binance founder Changpeng Zhao told crypto users to be “extra careful” visiting any website after two critical PHP flaws were found.
- The flaws, rated 9.2 out of 10, could let attackers run code on servers without logging in.
- PHP released emergency patches on October 21 after details leaked online early.
- Governments in Europe, Australia and elsewhere took websites offline as a precaution.
- Coinbase and BitGo said they were not affected, and no crypto losses have been linked to the flaws.
Binance founder Changpeng Zhao has warned cryptocurrency users to take extra care online after two critical security flaws were found in PHP. PHP is a programming language that powers millions of websites around the world.
“Call me paranoid, but be extra careful visiting ANY web site in the next few days,” Zhao wrote on October 22. He said some website administrators may not have installed the latest security fixes.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could let attackers run harmful code on web servers without logging in. They affect sites built on platforms such as WordPress, Magento, Drupal and Joomla.
The flaws affect servers, not visitors directly. Visiting a PHP-based website does not automatically put a person’s device or crypto wallet at risk.
How the PHP Flaws Work
The PHP Foundation gave both flaws a severity score of 9.2 out of 10. They involve weaknesses in how PHP manages memory and handles errors.
The first flaw involves memory corruption when PHP hits its memory limit. The second involves memory that stays reachable after it has been released. Security company Cloudflare called the pair “PHP2Shell.”
PHP released patched versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on October 21. The foundation urged administrators to update right away.
Details leaked online on October 20 with an incorrect severity score of 10.0. Security company Calif then published a proof of concept video by mistake, and the PHP team moved its release forward by one day.
The foundation admitted it first saw signs of the problem in 2024. It called the delay in fixing it a “structural failure” caused by its decision process and a lack of resources.
Calif and OpenAI later reported the same issue on August 11, which made it a top priority.
Governments and Crypto Firms Respond
Government agencies around the world took websites offline on Wednesday as a precaution. The Netherlands shut its digital identity service, while Finland, France and Germany disabled several public sites.
Australia’s cybersecurity website was also affected. Japanese Prime Minister Sanae Takaichi urged website operators to apply the patch as quickly as possible.
The Wikimedia Foundation took some support services offline, causing parts of Wikipedia to go down.
In crypto, security firm SlowMist found 793 domains with direct PHP fingerprints among 1,488 crypto domains it checked. It urged exchanges, DeFi platforms and wallet providers to upgrade.
Intersect, which supports Cardano’s development, took its Members Area offline while it reviewed its exposure. Coinbase said it found no exposed PHP instances, and BitGo said its platform was not affected.
Zhao’s warning follows recent phishing attacks on crypto users, including fake Ledger websites in Google search results. A hacked PHP server could let attackers change site content or add fake wallet connection requests.
The PHP security team said it had not identified any working exploits at the time of disclosure. As of press time, no security incidents at crypto exchanges or user wallets have been linked to the flaws.
