Binance Founder CZ Urges Online Caution After PHP Attack Attempts Hit Millions

Coinbase and BitGo Report No Exposure

Attack attempts against the newly disclosed PHP vulnerabilities have climbed into the millions, and the largest crypto companies moved on October 22 to publish statements on whether their systems were touched. According to Coinreaders, Coinbase (COIN) and BitGo both reported no evidence that their infrastructure was exposed. Binance said it applied protective measures before the official security patch was distributed and has completed the response it considers necessary. As of that reporting, no breach of a crypto company and no loss of user funds had been recorded. Binance cofounder Changpeng Zhao, known across the industry as CZ, warned users to be extremely careful about visiting any website over the coming days. His concern is that a site slow to patch could serve as a channel for stealing login credentials or attacking a visitor's device. The flaw class at the center of the alert lets an attacker execute code on a server without logging in first. PHP's development team shipped a fixed version on October 21, but every site operator has to install it themselves. Infrastructure figures show the scale of the scanning: Cloudflare recorded attempts rising into the hundreds of thousands within two hours of the disclosure, and into the millions afterward. Amazon said it observed attempts as early as October 17, before the flaws became public. A separate certificate problem also surfaced at Indian authority eMudhra, where eight intermediate certificates carried unusually weak private keys, a combination that would let an attacker forge certificates impersonating exchanges. Browsers have begun blocking them, though trading programs that keep their own certificate lists may not. Lightning Labs asked users of its Bitcoin and Lightning Network software to update immediately. Practical guidance circulating with the alert tells users to reach exchanges only through bookmarked official sites, to distrust urgent update pop-ups, and to compare every deposit address against a saved one before sending.

CVE-2026-109618 and CVE-2026-109619

The warning sits on top of two critical flaws in PHP, the server language behind a large share of the web, including every WordPress site. Both were fixed in an emergency security release on October 21, after their details leaked ahead of the planned disclosure. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and neither requires an attacker to log in. CZ wrote on X on October 21 that people may call him paranoid, but they should be very careful visiting any website in the coming days, because some site operators do not always keep their security systems current. He added that exploitation of the two flaws had been confirmed in the wild shortly after disclosure. The PHP Foundation's own account of the release differs in one respect. Its statement says the CVE numbers began circulating online on October 20 with an erroneous release date and an announced severity of 10 out of 10, while the actual score is 9.2. Calif, one of the parties that reported the flaws, mistakenly published a video explaining exploitation, and Chainguard shipped fixed builds more than six hours before the agreed time. The Foundation states it observed no real exploitation before the update went out, contrary to CZ's later remark. Government cyber agencies moved in parallel. The NSA advised PHP users to prepare for updates and to take affected systems offline if patching could not happen immediately. The FBI's Cyber Division repeated the recommendation and told operators to watch for PHP processes opening system commands unexpectedly. Among crypto platforms, Nina Rong of BNB Chain confirmed the network itself does not run PHP. PancakeSwap, the large BNB Chain DEX, said none of its infrastructure uses PHP and that user funds are safe. CZ reposted that statement with the comment that most projects should publish at least a confirmation of this kind.

@cz_binance · X post

Wrote on X.

View on X

The Leak Before the Patch

The PHP Foundation's release note, the primary document in this story, frames the risk window precisely: the flaw details were trading online on October 20 and the fix landed on October 21, so unpatched servers spent roughly a day with working exploit guidance in public. That mismatch, a stated severity of 10 against an actual 9.2, and a vendor shipping fixed builds six hours early all point to a coordinated disclosure process under visible strain rather than a routine patch cycle. For crypto users the residual exposure is narrower than the headlines suggest: no exchange breach or user fund loss has been confirmed. The practical risk is address substitution on a compromised site, and a hardware wallet, while it displays the sending address, cannot judge whether a hacked website presented a false one.