Binance founder Changpeng Zhao highlights critical PHP security vulnerabilities threatening website security and cryptocurrency platforms.

Binance Founder Warns of Critical PHP Security Flaws

By /

key insights

  • Administrators of the websites should install the right PHP updates as soon as possible and check websites with unsupported PHP versions.
  • Cryptocurrency platforms and solutions should check parties and make sure they are not at risk from old PHP versions.
  • Users should double-check website addresses, stay away from wallet requests and turn on two-factor authentication, for their exchange accounts.

On October 22, Binance founder Changpeng Zhao cautioned the internet users against visiting websites after the disclosure of two key PHP vulnerabilities. The vulnerabilities could allow for unauthenticated attackers to run malicious code on vulnerable servers, posing concerns over website security and potential issues for cryptocurrency users. On October 21, emergency patches were received due to advance information.

Emergency patches follow premature disclosure

Zhao urged users to remain vigilant while administrators update vulnerable systems. He posted a warning on X that there could be some website operators who might not update their sites timely with the security updates.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, received severity scores of 9.2 out of 10. They are created to affect PHP (a computer programming language that’s used by sites and content administration platforms).

The PHP Foundation says developers have been having trouble with fixing the root of the security issue since its discovery in 2024. Limited resources and difficulties developing a reliable fix repeatedly stalled progress.

Security firm Calif and OpenAI independently reported the underlying issue again on August 11. Calif demonstrated remote code execution, elevating the problem’s urgency. However, disclosure preparations faced further disruption in October. The vulnerability identifiers circulated online on October 20, accompanied by inaccurate severity information and release timing.

Calif subsequently published a proof-of-concept video by mistake. Chainguard also released patched software images more than six hours before the coordinated disclosure.

Consequently, the PHP security team advanced its planned release from October 22 to October 21. Developers have released updates, for PHP 8.2.35 PHP 8.3.36, PHP 8.4.27 and PHP 8.5.12.

Technical weaknesses create server-level risks

The two issues are about memory management and error handling problems that might leave servers open to attacks from outside.

CVE-2026-109618 is, about memory corruption that happens when PHP hits the memory limit set by the user during some actions. In some situations bad actors might use data that is not handled right to run code that they shouldn’t be allowed to run.

Meanwhile, CVE-2026-109619 concerns internal memory references that remain accessible after their associated memory has been released. Researchers demonstrated that this weakness could also enable remote code execution.

The PHP Foundation confirmed that attackers could exploit the vulnerabilities under default configurations of Apache servers using mod_php. Researchers also demonstrated additional attack paths involving PHP-FPM.

Cloudflare deployed firewall protections before the public disclosure. Nevertheless, the PHP Foundation warned administrators that temporary safeguards could not replace installing security updates.

The foundation admitted that its previous response showed a failure caused by limited staffing and internal decision‑making. The admission makes the foundation ask questions about how to keep security safe across the widely used open‑source infrastructure.

Government agencies and crypto platforms respond

It is due to such vulnerabilities that several countries implemented precautionary measures. Authorities and government IT organisations temporarily disconnected some online services as they figured out how much they were exposed to.

The Netherlands discontinued its digital identity service and Finland’s public website service provider terminated connections to public websites. France temporarily took prefecture websites offline, and Germany’s federal IT provider disabled several services.

Australia’s Signals Directorate also confirmed that cyber.gov.au faced disruption. Meanwhile, Japan’s Prime Minister Sanae Takaichi urged website operators to apply patches quickly or consider temporary suspensions. Some services on the Wikimedia Foundation’s host Toolforge and Cloud VPS have been temporarily shutdown as precaution due to the downtime.

Within cryptocurrency, SlowMist’s MistEye survey identified 793 domains with direct PHP fingerprints among 1,488 assessed. The findings led to warnings, for exchanges, decentralized finance platforms and wallet providers to check their infrastructure.

Cardano governance organization Intersect temporarily disabled its Members Area. However, Coinbase security chief Jeff Lunglhofer said the exchange found no evidence of exposed PHP instances. BitGo also reported that its platform remained unaffected.

BNB Chain executive Nina Rong said the network does not use PHP in its technology stack. PancakeSwap similarly confirmed that its infrastructure does not use PHP and that user funds remained safe.

Implications for cryptocurrency security

If the website’s server is compromised and the attackers can change the content of the usual pages, it could lead to exposing visitors to more danger. Depending on how much access they have, they can add false log-in forms or wallets connection requests.

But it is not enough to visit a PHP site to endanger the device or cryptocurrency wallet. The main vulnerability is in the weak servers, but a compromised website could provide a means of obtaining credentials.

Recent phishing attacks that use Ledger websites and emails related to Trezor show the bigger danger, from tricking online services. A real website that gets hacked can make these kinds of attacks harder for people to see through.

The PHP disclosure also highlighted the importance of coordinated security research. OpenAI said its models helped researchers identify the vulnerabilities through its Patch the Planet initiative.

Related Posts

Scroll to Top