Binance founder warns of critical PHP flaws exposing web servers

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, carry a severity score of 9.2 out of 10. They stem from weaknesses in memory management and error handling, potentially allowing attackers to compromise infrastructure without authentication. While Zhao’s warning focuses on the risk to crypto users who might encounter compromised sites, the threat is broad, affecting any server running platforms like WordPress, Magento, Drupal, or Joomla.

Emergency response and security fallout

The PHP Foundation accelerated its patch release to October 21 after technical details leaked prematurely on social media. Despite the rapid deployment of updates—versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12—the risk remains high for legacy installations that rely on third-party vendors for security fixes. Security firm Cloudflare, which identified the risks under the collective name PHP2Shell, deployed firewall protections ahead of the disclosure to mitigate potential remote code execution. Although no direct attacks on cryptocurrency wallets have been confirmed, the ability for hackers to alter website content remains a significant concern for users susceptible to phishing campaigns.