Changpeng Zhao warned internet users on October 22 to exercise caution when visiting websites after developers patched two critical PHP vulnerabilities. The flaws could let attackers take control of vulnerable web servers without a password. His warning followed the release of emergency fixes for PHP2Shell, which affects the technology behind publishing and online shopping platforms.
The weaknesses, tracked as CVE-2026-109618 and CVE-2026-109619, each carry a severity score of 9.2 out of 10. WordPress, Magento, Drupal, and Joomla use PHP, placing sites with unpatched server installations at risk. The weaknesses could expose stored information or let intruders change content that a compromised website delivers.
“Call me paranoid, but be extra careful visiting ANY web site in the next few days,” Zhao wrote. He warned that some website operators might lag behind the latest security updates.
The warning did not establish that ordinary visits to PHP websites automatically infect users' devices or drain cryptocurrency wallets. Instead, attackers could target vulnerable servers and potentially alter what visitors see.
That possibility raises a central question: Could compromised websites become another route for cryptocurrency phishing attacks? Attackers who gain control of a site could introduce false login pages or deceptive wallet connection requests.
Recent phishing incidents already show how criminals target crypto users. Fake Ledger websites appeared in Google search results and sought wallet recovery phrases. Separately, fraudulent Trezor emails used compromised third-party infrastructure to distribute misleading security notices.
Still, no confirmed attack on a cryptocurrency exchange or user wallet had been directly linked to these newly disclosed PHP flaws at the time of the warning.
The PHP Foundation linked CVE-2026-109618 to a fault in how the software handles memory limits. Certain operations can leave internal data only partly prepared before the server processes it incorrectly.
The second flaw, CVE-2026-109619, involves internal references that remain after the software frees their memory. Researchers showed how attackers could exploit that weakness to run unauthorized code.
Both flaws can permit remote attacks without authentication. Researchers demonstrated exploitation involving Apache servers using mod_php under default settings. They also identified additional attack paths involving PHP-FPM.
Developers released PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on October 21. The PHP advisory urged immediate installation because temporary defenses cannot fully remove the threat.
Older PHP installations pose a separate challenge. Administrators running unsupported versions may need fixes from their hosting companies or software suppliers rather than the main PHP project. Site operators must therefore check which PHP versions their providers maintain and whether fixes are available.
Read More: Changpeng Zhao Says Trump Pardon Was Unexpected, Denies Business Ties to Trump Family
The release came one day earlier than planned after details began circulating online. On October 20, posts revealed both vulnerability identifiers but gave an incorrect 10.0 severity score and inaccurate release timing.
The initial leak contained no exploit instructions. Later, security company Calif mistakenly posted a demonstration video showing attacks against several targets. Copies spread after the company removed it.
The PHP Foundation said those disclosures helped other researchers develop exploit demonstrations. It then moved the planned October 22 release to October 21 so administrators could gain access to patches sooner.
The foundation also criticized Chainguard for publishing patched software images more than six hours before the coordinated release. It said early access to the changes could help attackers study the fixes.
Meanwhile, Cloudflare deployed firewall protections after working with researchers from OpenAI, Wiz and other organizations. The company warned that PHP2Shell could expose server data, disrupt services and enable unauthorized code execution.
Canada's Cyber Security Centre urged organizations to locate exposed PHP applications and update them immediately. The call focused on internet-facing servers, where attackers could reach vulnerable software remotely. It directed administrators to prioritize exposed systems.
Zhao’s warning follows the disclosure of two critical PHP2Shell flaws that could let attackers seize control of unpatched servers. Developers issued fixes on October 21 after leaks disrupted the rollout. Website administrators should install supported updates promptly, while cryptocurrency users should remain alert to fraudulent login and wallet requests.