CZ warns crypto users of critical unpatched PHP vulnerabilities exploitable without credentials; NSA/FBI recommend immediate patching or offline status.
Regulation & Gov ·
Changpeng Zhao has alerted cryptocurrency users to exercise caution when browsing websites, citing recently patched PHP vulnerabilities that attackers can exploit without requiring login credentials. The NSA and FBI have issued guidance recommending organizations using PHP either update their systems immediately or move them offline, after confirming active exploitation attempts. The affected CVE identifiers are CVE-2026-109618 and CVE-2026-109619, with WordPress and Magento servers identified as vulnerable platforms.
In response to these threats, several major crypto entities have moved to reassure users. BNB Chain and PancakeSwap released statements indicating their infrastructure remains unaffected by the vulnerabilities. OpenAI also weighed in, acknowledging the severity of the bugs and its involvement in their discovery.
Whether broader ecosystem infrastructure beyond the named protocols has been scanned or patched remains unclear, as does the full scope of real-world compromises to date beyond confirmed exploitation attempts.